rcf-lite 0.22.0 → 0.24.0

package/blueprints/edge-cloudflare-turnstile/contributions/probes/event-secrecy.mjs

@@ -0,0 +1,51 @@
+// Probe: every event record carries sitekeyHash, outcome and timestamp only; never the token, never the secret.
+// anchorAcId: AC-35108-1. accountBound: false. Drives one pass and one fail through the live siteverify endpoint.
+
+export const anchorAcId = 'AC-35108-1';
+export const accountBound = false;
+
+export default async function runProbe() {
+  const { TEST_SECRETS, TEST_SITEKEYS, bootFixture } = await import('./probe-utils.mjs');
+  const results = [];
+
+  const fixture = await bootFixture({ TURNSTILE_SECRET: TEST_SECRETS.alwaysPass, TURNSTILE_SITEKEY: TEST_SITEKEYS.alwaysPass, TURNSTILE_FAIL_SECRET: TEST_SECRETS.alwaysFail });
+  try {
+    await fetch(`${fixture.url}/api/events/clear`, { method: 'POST' });
+    // Pass branch: submit with any token.
+    const passBody = new URLSearchParams();
+    passBody.set('email', 'reviewer@example.com');
+    passBody.set('turnstile-sitekey', TEST_SITEKEYS.alwaysPass);
+    passBody.set('cf-turnstile-response', 'PASS-TOKEN-LITERAL-XYZ');
+    const passResp = await fetch(`${fixture.url}/api/submit`, {
+      method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded' }, body: passBody,
+    });
+
+    // Fail branch: submit with fail-secret=1 forcing the always-fail secret path.
+    const failBody = new URLSearchParams();
+    failBody.set('email', 'reviewer@example.com');
+    failBody.set('turnstile-sitekey', TEST_SITEKEYS.alwaysBlock);
+    failBody.set('cf-turnstile-response', 'FAIL-TOKEN-LITERAL-ABC');
+    const failResp = await fetch(`${fixture.url}/api/submit?fail-secret=1`, {
+      method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded' }, body: failBody,
+    });
+
+    const events = await (await fetch(`${fixture.url}/api/events`)).json();
+    const allowed = new Set(['sitekeyHash', 'outcome', 'timestamp']);
+    const extraKeyRecords = events.filter((r) => Object.keys(r).some((k) => !allowed.has(k)));
+    const forbiddenSubstrings = ['PASS-TOKEN-LITERAL-XYZ', 'FAIL-TOKEN-LITERAL-ABC', TEST_SECRETS.alwaysPass, TEST_SECRETS.alwaysFail];
+    const serialized = JSON.stringify(events);
+    const leaks = forbiddenSubstrings.filter((s) => serialized.includes(s));
+    const outcomes = events.map((e) => e.outcome).sort();
+    const shapeOk = events.length === 2 && extraKeyRecords.length === 0 && leaks.length === 0
+      && outcomes[0] === 'refused' && outcomes[1] === 'verified';
+    results.push({
+      anchorAcId: 'AC-35108-1',
+      verdict: shapeOk ? 'pass' : 'fail',
+      detail: shapeOk
+        ? `event-secrecy: 2 events captured, keys=[sitekeyHash,outcome,timestamp] only; no token or secret leak; outcomes=${JSON.stringify(outcomes)}; passResp=${passResp.status} failResp=${failResp.status}`
+        : `event-secrecy failure: events=${events.length} extraKeyRecords=${JSON.stringify(extraKeyRecords)} leaks=${JSON.stringify(leaks)} outcomes=${JSON.stringify(outcomes)} passResp=${passResp.status} failResp=${failResp.status}`,
+    });
+  } finally { await fixture.stop(); }
+
+  return { results };
+}

package/blueprints/edge-cloudflare-turnstile/contributions/probes/guard-shape-scan.mjs

@@ -0,0 +1,48 @@
+// Probe: every elicited surface in the pack fixture source registers under the token-required guard;
+// a live missing-token submit is refused with 400 before any downstream handler runs.
+// anchorAcId: AC-35104-1. accountBound: false.
+
+export const anchorAcId = 'AC-35104-1';
+export const accountBound = false;
+
+export default async function runProbe() {
+  const { FIXTURE_DIR, bootFixture, fixturePost, readFileText } = await import('./probe-utils.mjs');
+  const { resolve } = await import('node:path');
+  const results = [];
+
+  // 1. Source scan: server.js must register the guard on every guarded surface.
+  const serverSrc = await readFileText(resolve(FIXTURE_DIR, 'server.js'));
+  // The guard is the tokenRequiredGuard function; every POST route on a guarded surface must call it.
+  const guardedSurfacesPattern = /GUARDED_SURFACES/;
+  const guardCallPattern = /tokenRequiredGuard\(req, res, params\)/;
+  const surfaceCheckPattern = /if \(!GUARDED_SURFACES\.includes/;
+  const hasGuardedSurfaces = guardedSurfacesPattern.test(serverSrc);
+  const hasGuardCall = guardCallPattern.test(serverSrc);
+  const hasSurfaceCheck = surfaceCheckPattern.test(serverSrc);
+  const scanOk = hasGuardedSurfaces && hasGuardCall && hasSurfaceCheck;
+  results.push({
+    anchorAcId: 'AC-35104-1',
+    verdict: scanOk ? 'pass' : 'fail',
+    detail: scanOk
+      ? 'guard-shape scan: GUARDED_SURFACES declared, tokenRequiredGuard called on POST handlers, surface-check gate present before guard call'
+      : `guard-shape scan miss: GUARDED_SURFACES=${hasGuardedSurfaces}, guardCall=${hasGuardCall}, surfaceCheck=${hasSurfaceCheck}`,
+  });
+
+  // 2. Live refuse: missing-token POST to every guarded surface returns 400 with turnstile.token-missing.
+  const fixture = await bootFixture();
+  try {
+    for (const path of ['/api/submit', '/api/magic-link']) {
+      const resp = await fixturePost(fixture.url, path, { email: 'reviewer@example.com', 'turnstile-sitekey': '1x00000000000000000000AA' });
+      const ok = resp.status === 400 && resp.json && resp.json.errorCode === 'turnstile.token-missing';
+      results.push({
+        anchorAcId: 'AC-35104-1',
+        verdict: ok ? 'pass' : 'fail',
+        detail: ok
+          ? `guard rejected missing-token submit on ${path} with status=400 errorCode=turnstile.token-missing`
+          : `guard unexpected shape on ${path} status=${resp.status} body=${resp.text}`,
+      });
+    }
+  } finally { await fixture.stop(); }
+
+  return { results };
+}

package/blueprints/edge-cloudflare-turnstile/contributions/probes/probe-utils.mjs

@@ -0,0 +1,139 @@
+// Shared helpers for edge-cloudflare-turnstile probes.
+//
+// Runtime-dependency posture: probes drive the shipped pack fixture at
+// packages/rcf-lite/test/fixtures/probe-pack-edge-cloudflare-turnstile so
+// rcf-lite gains no new runtime dependency (Node's built-in http, url and
+// crypto modules cover the fixture). Two probes are pure source-tree AST
+// scans (secret-shape-scan, guard-shape-scan); two probes drive the live
+// https://challenges.cloudflare.com/turnstile/v0/siteverify endpoint with
+// the pinned Cloudflare public test keys documented at
+// https://developers.cloudflare.com/turnstile/troubleshooting/testing/
+// (siteverify-fixture, event-secrecy).
+
+import { mkdir, writeFile, readFile, readdir, stat } from 'node:fs/promises';
+import { spawn } from 'node:child_process';
+import { dirname, resolve, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+
+export const PROJECT_ROOT = resolve(HERE, '..', '..', '..', '..');
+export const FIXTURE_DIR = resolve(PROJECT_ROOT, 'packages/rcf-lite/test/fixtures/probe-pack-edge-cloudflare-turnstile');
+export const REPORT_DIR = resolve(PROJECT_ROOT, '.rcf/reports/blueprints/edge-cloudflare-turnstile');
+
+// Pinned Cloudflare Turnstile public test keys per
+// https://developers.cloudflare.com/turnstile/troubleshooting/testing/.
+export const TEST_SITEKEYS = Object.freeze({
+  alwaysPass: '1x00000000000000000000AA',
+  alwaysBlock: '2x00000000000000000000AB',
+  forcedInteractive: '3x00000000000000000000FF',
+  invisiblePass: '1x00000000000000000000BB',
+  invisibleBlock: '2x00000000000000000000BB',
+});
+export const TEST_SECRETS = Object.freeze({
+  alwaysPass: '1x0000000000000000000000000000000AA',
+  alwaysFail: '2x0000000000000000000000000000000AA',
+  tokenSpent: '3x0000000000000000000000000000000AA',
+});
+export const SITEVERIFY_URL = 'https://challenges.cloudflare.com/turnstile/v0/siteverify';
+
+export function aggregate(results) {
+  if (results.some((r) => r.verdict === 'fail')) return 'fail';
+  if (results.some((r) => r.verdict === 'warn')) return 'warn';
+  return 'pass';
+}
+
+export async function writeReport({ probeName, engine, results, extra }) {
+  await mkdir(REPORT_DIR, { recursive: true });
+  const report = {
+    slug: 'edge-cloudflare-turnstile',
+    probeName,
+    runAt: new Date().toISOString(),
+    engine,
+    results,
+    aggregateVerdict: aggregate(results),
+    ...(extra ?? {}),
+  };
+  const path = resolve(REPORT_DIR, `${probeName}.json`);
+  await writeFile(path, JSON.stringify(report, null, 2) + '\n', 'utf8');
+  return { report, path };
+}
+
+export async function runShim(probeName, engine, mainFn) {
+  try {
+    const { results, extra } = await mainFn();
+    const { report, path } = await writeReport({ probeName, engine, results, extra });
+    process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+    process.stdout.write(`report written to ${path}\n`);
+    if (report.aggregateVerdict === 'fail') process.exitCode = 1;
+  } catch (err) {
+    const results = [{
+      anchorAcId: 'unknown',
+      verdict: 'fail',
+      detail: `probe threw: ${err && err.message ? err.message : String(err)}`,
+    }];
+    const { report, path } = await writeReport({ probeName, engine, results });
+    process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+    process.stderr.write(`probe error: ${err && err.stack ? err.stack : String(err)}\n`);
+    process.stderr.write(`report written to ${path}\n`);
+    process.exitCode = 1;
+  }
+}
+
+// Boot the pack fixture on a free port. Returns {url, stop}.
+export async function bootFixture(env = {}) {
+  const child = spawn(process.execPath, ['server.js'], {
+    cwd: FIXTURE_DIR,
+    env: { ...process.env, PORT: '0', ...env },
+    stdio: ['ignore', 'pipe', 'pipe'],
+  });
+  const port = await new Promise((resolveP, rejectP) => {
+    const timer = setTimeout(() => rejectP(new Error('fixture boot timeout')), 8000);
+    let buf = '';
+    child.stdout.on('data', (d) => {
+      buf += String(d);
+      const m = buf.match(/LISTENING (\d+)/);
+      if (m) { clearTimeout(timer); resolveP(Number(m[1])); }
+    });
+    child.stderr.on('data', (d) => { buf += String(d); });
+    child.on('exit', (code) => { clearTimeout(timer); rejectP(new Error(`fixture exited early code=${code}: ${buf}`)); });
+  });
+  return {
+    url: `http://127.0.0.1:${port}`,
+    stop: () => new Promise((resolveP) => { child.once('exit', () => resolveP()); child.kill('SIGTERM'); }),
+    child,
+  };
+}
+
+export async function fixturePost(url, path, body) {
+  const params = new URLSearchParams();
+  for (const [k, v] of Object.entries(body)) params.set(k, String(v));
+  const resp = await fetch(`${url}${path}`, {
+    method: 'POST',
+    headers: { 'content-type': 'application/x-www-form-urlencoded' },
+    body: params,
+  });
+  const text = await resp.text();
+  let json = null;
+  try { json = JSON.parse(text); } catch { /* leave null */ }
+  return { status: resp.status, json, text };
+}
+
+// Recursively walk a directory and return every file path with one of the given extensions.
+export async function collectFiles(root, exts = ['.js', '.mjs', '.cjs', '.ts']) {
+  const out = [];
+  async function walk(dir) {
+    let entries;
+    try { entries = await readdir(dir, { withFileTypes: true }); } catch { return; }
+    for (const e of entries) {
+      if (e.name === 'node_modules' || e.name === 'proof' || e.name === '.git') continue;
+      const p = join(dir, e.name);
+      if (e.isDirectory()) await walk(p);
+      else if (exts.some((x) => e.name.endsWith(x))) out.push(p);
+    }
+  }
+  await walk(root);
+  return out;
+}
+
+export async function readFileText(p) { return readFile(p, 'utf8'); }

package/blueprints/edge-cloudflare-turnstile/contributions/probes/run-event-secrecy.mjs

@@ -0,0 +1,5 @@
+import runProbe from './event-secrecy.mjs';
+import { runShim } from './probe-utils.mjs';
+
+const engine = { kind: 'live-endpoint', image: 'Cloudflare siteverify endpoint via probe-pack-edge-cloudflare-turnstile fixture; event sink asserted for secrecy', healthy: true };
+runShim('event-secrecy', engine, runProbe);

package/blueprints/edge-cloudflare-turnstile/contributions/probes/run-guard-shape-scan.mjs

@@ -0,0 +1,5 @@
+import runProbe from './guard-shape-scan.mjs';
+import { runShim } from './probe-utils.mjs';
+
+const engine = { kind: 'source-tree-plus-live', image: 'source AST scan plus live POST against probe-pack-edge-cloudflare-turnstile fixture', healthy: true };
+runShim('guard-shape-scan', engine, runProbe);

package/blueprints/edge-cloudflare-turnstile/contributions/probes/run-secret-shape-scan.mjs

@@ -0,0 +1,5 @@
+import runProbe from './secret-shape-scan.mjs';
+import { runShim } from './probe-utils.mjs';
+
+const engine = { kind: 'source-tree', image: 'AST-shaped source scan over probe-pack-edge-cloudflare-turnstile fixture', healthy: true };
+runShim('secret-shape-scan', engine, runProbe);

package/blueprints/edge-cloudflare-turnstile/contributions/probes/run-siteverify-fixture.mjs

@@ -0,0 +1,5 @@
+import runProbe from './siteverify-fixture.mjs';
+import { runShim } from './probe-utils.mjs';
+
+const engine = { kind: 'live-endpoint', image: 'Cloudflare siteverify endpoint challenges.cloudflare.com/turnstile/v0/siteverify via probe-pack-edge-cloudflare-turnstile fixture', healthy: true };
+runShim('siteverify-fixture', engine, runProbe);

package/blueprints/edge-cloudflare-turnstile/contributions/probes/secret-shape-scan.mjs

@@ -0,0 +1,77 @@
+// Probe: TURNSTILE_SECRET is read only via env-shaped identifiers; no non-test-key secret literal in the pack fixture source.
+// anchorAcId: AC-35107-1. accountBound: false.
+//
+// The pack fixture pins the Cloudflare public test keys as environment defaults so the pack does not need real Turnstile credentials
+// to run (spec section 3.2). The test keys are documented at https://developers.cloudflare.com/turnstile/troubleshooting/testing/
+// and are public per Cloudflare; the scan allows those literals only and refuses any other secret-shaped literal.
+
+export const anchorAcId = 'AC-35107-1';
+export const accountBound = false;
+
+export default async function runProbe() {
+  const { FIXTURE_DIR, TEST_SECRETS, collectFiles, readFileText } = await import('./probe-utils.mjs');
+  const results = [];
+
+  const files = await collectFiles(FIXTURE_DIR, ['.js', '.mjs', '.cjs']);
+  // 1. Every TURNSTILE_SECRET reference must be an env-shaped read (process.env.TURNSTILE_SECRET).
+  const envReadPattern = /process\.env\.TURNSTILE_(?:SECRET|FAIL_SECRET|SITEKEY|INVISIBLE_SITEKEY|INVISIBLE_BLOCK_SITEKEY|BLOCK_SITEKEY|FORCED_SITEKEY|WIDGET_MODE|GUARDED_SURFACES)\b/;
+  const bareRefPattern = /\bTURNSTILE_SECRET\b/g;
+
+  let envReadCount = 0;
+  let bareRefCount = 0;
+  const bareRefLocations = [];
+
+  for (const file of files) {
+    const src = await readFileText(file);
+    const bare = [...src.matchAll(bareRefPattern)];
+    for (const m of bare) {
+      const window = src.slice(Math.max(0, m.index - 40), m.index + m[0].length);
+      if (window.match(envReadPattern)) envReadCount++;
+      else {
+        const lineStart = src.lastIndexOf('\n', m.index) + 1;
+        const lineEnd = src.indexOf('\n', m.index);
+        const line = src.slice(lineStart, lineEnd === -1 ? src.length : lineEnd);
+        const beforeCommented = line.slice(0, m.index - lineStart).includes('//');
+        if (beforeCommented || line.trim().startsWith('//') || line.trim().startsWith('*')) continue;
+        bareRefCount++;
+        bareRefLocations.push({ file: file.replace(FIXTURE_DIR + '/', ''), line: src.slice(0, m.index).split('\n').length });
+      }
+    }
+  }
+
+  results.push({
+    anchorAcId: 'AC-35107-1',
+    verdict: (envReadCount >= 1 && bareRefCount === 0) ? 'pass' : 'fail',
+    detail: (envReadCount >= 1 && bareRefCount === 0)
+      ? `TURNSTILE_SECRET is read only via env-shaped identifiers; envReads=${envReadCount}, bareOutsideEnvFacade=0, filesScanned=${files.length}`
+      : `TURNSTILE_SECRET bare references outside process.env facade: ${JSON.stringify(bareRefLocations)}`,
+  });
+
+  // 2. No non-pinned-test secret literal appears in source. Cloudflare public test keys (documented on
+  // https://developers.cloudflare.com/turnstile/troubleshooting/testing/) are the ONLY secret-shaped
+  // literals allowed as env defaults per spec section 3.2.
+  const allowedTestSecrets = new Set(Object.values(TEST_SECRETS));
+  // A secret-shaped literal is a 30-char-or-longer alphanumeric string sitting inside single or double quotes.
+  const secretLiteralPattern = /["']([A-Za-z0-9_-]{30,})["']/g;
+  const leaks = [];
+  for (const file of files) {
+    const src = await readFileText(file);
+    let m;
+    while ((m = secretLiteralPattern.exec(src)) !== null) {
+      const lit = m[1];
+      if (allowedTestSecrets.has(lit)) continue;
+      // Ignore obvious non-secrets: URLs (contain slashes), function names.
+      if (lit.startsWith('http') || lit.includes('/')) continue;
+      leaks.push({ file: file.replace(FIXTURE_DIR + '/', ''), fragment: lit.slice(0, 8) + '...' });
+    }
+  }
+  results.push({
+    anchorAcId: 'AC-35107-1',
+    verdict: leaks.length === 0 ? 'pass' : 'fail',
+    detail: leaks.length === 0
+      ? `only Cloudflare public test secrets appear as env defaults (allowed per Cloudflare testing docs); no other secret-shaped literal found in ${files.length} files`
+      : `unexpected secret-shaped literal in fixture source: ${JSON.stringify(leaks)}`,
+  });
+
+  return { results, extra: { filesScanned: files.length, allowedTestSecretCount: allowedTestSecrets.size } };
+}

package/blueprints/edge-cloudflare-turnstile/contributions/probes/siteverify-fixture.mjs

@@ -0,0 +1,53 @@
+// Probe: server-side siteverify with pinned always-pass secret returns success:true;
+// with pinned always-fail secret returns success:false. anchorAcId: AC-35102-1. accountBound: false.
+// Drives the LIVE Cloudflare siteverify endpoint per spec section 3.1 (real-engine rule)
+// with the public test keys documented at
+// https://developers.cloudflare.com/turnstile/troubleshooting/testing/.
+
+export const anchorAcId = 'AC-35102-1';
+export const accountBound = false;
+
+export default async function runProbe() {
+  const { TEST_SECRETS, SITEVERIFY_URL, bootFixture, fixturePost, TEST_SITEKEYS } = await import('./probe-utils.mjs');
+  const results = [];
+
+  // Pass branch: drive siteverify with always-pass secret via the shipped verifier
+  const passFixture = await bootFixture({ TURNSTILE_SECRET: TEST_SECRETS.alwaysPass, TURNSTILE_SITEKEY: TEST_SITEKEYS.alwaysPass });
+  try {
+    const passResp = await fixturePost(passFixture.url, '/api/submit', {
+      email: 'reviewer@example.com',
+      'turnstile-sitekey': TEST_SITEKEYS.alwaysPass,
+      'cf-turnstile-response': 'XXXX.DUMMY.TOKEN.XXXX',
+    });
+    const okPass = passResp.status === 200 && passResp.json && passResp.json.received === 'ok';
+    results.push({
+      anchorAcId: 'AC-35102-1',
+      verdict: okPass ? 'pass' : 'fail',
+      detail: okPass
+        ? `siteverify pass via ${SITEVERIFY_URL} with always-pass secret returned success:true; fixture /api/submit responded status=200 body=${JSON.stringify(passResp.json)}`
+        : `siteverify pass unexpected shape status=${passResp.status} body=${passResp.text}`,
+    });
+  } finally { await passFixture.stop(); }
+
+  // Fail branch: drive siteverify with always-fail secret; handler must reject with 400 and errorCodes
+  const failFixture = await bootFixture({ TURNSTILE_SECRET: TEST_SECRETS.alwaysFail, TURNSTILE_SITEKEY: TEST_SITEKEYS.alwaysBlock });
+  try {
+    const failResp = await fixturePost(failFixture.url, '/api/submit', {
+      email: 'reviewer@example.com',
+      'turnstile-sitekey': TEST_SITEKEYS.alwaysBlock,
+      'cf-turnstile-response': 'XXXX.DUMMY.TOKEN.XXXX',
+    });
+    const errorCodes = failResp.json && failResp.json.errorCodes;
+    const codesOk = Array.isArray(errorCodes) && errorCodes.length > 0;
+    const okFail = failResp.status === 400 && failResp.json && failResp.json.errorCode === 'turnstile.siteverify-failed' && codesOk;
+    results.push({
+      anchorAcId: 'AC-35102-1',
+      verdict: okFail ? 'pass' : 'fail',
+      detail: okFail
+        ? `siteverify fail via ${SITEVERIFY_URL} with always-fail secret returned success:false; fixture /api/submit responded status=400 errorCode=turnstile.siteverify-failed errorCodes=${JSON.stringify(errorCodes)}`
+        : `siteverify fail unexpected shape status=${failResp.status} body=${failResp.text}`,
+    });
+  } finally { await failFixture.stop(); }
+
+  return { results };
+}

package/blueprints/edge-cloudflare-turnstile/contributions/requirements/edge-cloudflare-turnstile-req-001.json

@@ -0,0 +1,17 @@
+{
+  "reqId": "edge-cloudflare-turnstile-REQ-001",
+  "prdId": "PRD-001",
+  "title": "Client widget mount: an elicited sitekey renders the Turnstile widget and the mount injects no third-party script beyond Cloudflare Turnstile JS host",
+  "description": "The applying project reaches Cloudflare Turnstile through a client widget mount that renders on elicited surfaces using the elicited TURNSTILE_SITEKEY. The mount injects only Cloudflare Turnstile JS from the Cloudflare Turnstile host (https://challenges.cloudflare.com/turnstile/v0/api.js per https://developers.cloudflare.com/turnstile/) and no other third-party script. On submit the widget populates a hidden Cf-Turnstile-Response token field the form payload carries.",
+  "category": "functional",
+  "domain": "edge",
+  "priority": "must",
+  "rationale": "Ratified in the Cloudflare round 6 spec (2026-09-06 section 5.5). Ships as v1.0.0 of edge-cloudflare-turnstile.",
+  "tags": [
+    "blueprint:edge-cloudflare-turnstile"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-07T20:00:00.000Z",
+  "updatedAt": "2026-09-07T20:00:00.000Z"
+}

package/blueprints/edge-cloudflare-turnstile/contributions/requirements/edge-cloudflare-turnstile-req-002.json

@@ -0,0 +1,17 @@
+{
+  "reqId": "edge-cloudflare-turnstile-REQ-002",
+  "prdId": "PRD-001",
+  "title": "Server-side siteverify: POST to https://challenges.cloudflare.com/turnstile/v0/siteverify with the elicited secret; success:true proceeds, failure rejects 400",
+  "description": "The applying project verifies every Turnstile response token server-side by POSTing {secret: TURNSTILE_SECRET, response: token} to https://challenges.cloudflare.com/turnstile/v0/siteverify. On success:true the handler proceeds; on success:false the handler rejects with 400 and the refusal body carries the documented error-codes value, not the sitekey or the secret.",
+  "category": "functional",
+  "domain": "edge",
+  "priority": "must",
+  "rationale": "Ratified in the Cloudflare round 6 spec (2026-09-06 section 5.5). Ships as v1.0.0 of edge-cloudflare-turnstile.",
+  "tags": [
+    "blueprint:edge-cloudflare-turnstile"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-07T20:00:00.000Z",
+  "updatedAt": "2026-09-07T20:00:00.000Z"
+}

package/blueprints/edge-cloudflare-turnstile/contributions/requirements/edge-cloudflare-turnstile-req-003.json

@@ -0,0 +1,17 @@
+{
+  "reqId": "edge-cloudflare-turnstile-REQ-003",
+  "prdId": "PRD-001",
+  "title": "Refuse-if-token-missing guard on elicited surfaces: a submit without a token is rejected with 400 before any downstream logic",
+  "description": "The applying project registers a token-required guard at every elicited surface. A submit whose payload lacks the Cf-Turnstile-Response field is rejected with 400 before any downstream handler runs. The refusal body carries a stable error-code (turnstile.token-missing), not the sitekey.",
+  "category": "functional",
+  "domain": "edge",
+  "priority": "must",
+  "rationale": "Ratified in the Cloudflare round 6 spec (2026-09-06 section 5.5). Ships as v1.0.0 of edge-cloudflare-turnstile.",
+  "tags": [
+    "blueprint:edge-cloudflare-turnstile"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-07T20:00:00.000Z",
+  "updatedAt": "2026-09-07T20:00:00.000Z"
+}

package/blueprints/edge-cloudflare-turnstile/contributions/requirements/edge-cloudflare-turnstile-req-004.json

@@ -0,0 +1,17 @@
+{
+  "reqId": "edge-cloudflare-turnstile-REQ-004",
+  "prdId": "PRD-001",
+  "title": "Composition with security-auth-magic-link: when both applied, the magic-link mint surface refuses submit without a valid Turnstile token",
+  "description": "When security-auth-magic-link and edge-cloudflare-turnstile are both applied, the magic-link mint surface reads through the Turnstile guard: a mint submit without a valid Turnstile response is refused with 400 before the mint fires. Composition uses the TAC-3603 hook.",
+  "category": "functional",
+  "domain": "edge",
+  "priority": "must",
+  "rationale": "Ratified in the Cloudflare round 6 spec (2026-09-06 section 5.5). Ships as v1.0.0 of edge-cloudflare-turnstile.",
+  "tags": [
+    "blueprint:edge-cloudflare-turnstile"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-07T20:00:00.000Z",
+  "updatedAt": "2026-09-07T20:00:00.000Z"
+}

package/blueprints/edge-cloudflare-turnstile/contributions/requirements/edge-cloudflare-turnstile-req-005.json

@@ -0,0 +1,17 @@
+{
+  "reqId": "edge-cloudflare-turnstile-REQ-005",
+  "prdId": "PRD-001",
+  "title": "Widget mode elicit: managed, non-interactive, invisible per Cloudflare Turnstile documented modes; recommendedDefault managed",
+  "description": "The applying operator elicits one of Cloudflare Turnstile documented widget modes: managed (default; challenge shown only when Cloudflare deems it necessary), non-interactive (always shows a non-interactive challenge) or invisible (mounts an invisible widget). The default mode is managed per ADR-3602.",
+  "category": "functional",
+  "domain": "edge",
+  "priority": "must",
+  "rationale": "Ratified in the Cloudflare round 6 spec (2026-09-06 section 5.5). Ships as v1.0.0 of edge-cloudflare-turnstile.",
+  "tags": [
+    "blueprint:edge-cloudflare-turnstile"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-07T20:00:00.000Z",
+  "updatedAt": "2026-09-07T20:00:00.000Z"
+}

package/blueprints/edge-cloudflare-turnstile/contributions/tacs/tac-3601-edge-cloudflare-turnstile-widget-mount.json

@@ -0,0 +1,26 @@
+{
+  "tacId": "TAC-3601-edge-cloudflare-turnstile-widget-mount",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "name": "Turnstile client widget mount with elicited sitekey and third-party script pin",
+  "purpose": "The client-side widget mount module for Cloudflare Turnstile. Mounts the Turnstile widget on elicited surfaces with the elicited TURNSTILE_SITEKEY. Injects only Cloudflare Turnstile JS from the Cloudflare Turnstile host (https://challenges.cloudflare.com/turnstile/v0/api.js per https://developers.cloudflare.com/turnstile/) and no other third-party script. Populates the hidden Cf-Turnstile-Response token field on submit. Widget mode is per ADR-3602 (managed, non-interactive, invisible).",
+  "responsibilities": [
+    "Render the Turnstile widget on every elicited surface with the elicited TURNSTILE_SITEKEY (AC-35101-1).",
+    "Inject only Cloudflare Turnstile JS from the Cloudflare Turnstile host; refuse any other third-party script.",
+    "Populate the hidden Cf-Turnstile-Response token field on the form payload before submit fires.",
+    "Honour the elicited widget mode enum: managed, non-interactive, invisible (AC-35106-1)."
+  ],
+  "internalStructure": "One client module realising the Turnstile mount. In the pack fixture the mount is inline in the served HTML for auditability; in an applied Workers project the mount ships as a small module the operator drops into the elicited surface.",
+  "interfaces": [
+    {
+      "name": "mountTurnstile",
+      "kind": "function",
+      "summary": "Mount the Turnstile widget onto a target element with the elicited sitekey and widget mode."
+    }
+  ],
+  "dependencies": [],
+  "createdAt": "2026-09-07T20:00:00.000Z",
+  "updatedAt": "2026-09-07T20:00:00.000Z"
+}

package/blueprints/edge-cloudflare-turnstile/contributions/tacs/tac-3602-edge-cloudflare-turnstile-server-verifier.json

@@ -0,0 +1,36 @@
+{
+  "tacId": "TAC-3602-edge-cloudflare-turnstile-server-verifier",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "name": "Turnstile server-side siteverify verifier and refuse-if-token-missing guard",
+  "purpose": "The server-side verifier module. POSTs {secret, response} to https://challenges.cloudflare.com/turnstile/v0/siteverify per Cloudflare Turnstile documented endpoint. On success:true proceeds; on success:false rejects 400 with error-codes body per ADR-3603. The refuse-if-token-missing guard is the sole reader of the Cf-Turnstile-Response payload field and rejects missing-token submits with 400 before any downstream handler runs.",
+  "responsibilities": [
+    "Own the ONLY reference to https://challenges.cloudflare.com/turnstile/v0/siteverify in the applied source tree (AC-35102-1, AC-35103-1).",
+    "Read TURNSTILE_SECRET only via env-shaped facade; refuse any inline literal (AC-35107-1).",
+    "Register the token-required guard at every elicited surface (AC-35104-1).",
+    "Emit event records with {sitekeyHash, outcome, timestamp} keys only; never carry the token or the secret (AC-35108-1)."
+  ],
+  "internalStructure": "One module (server verifier) exporting createTurnstileVerifier({env, eventSink, fetch}) returning {verify, guard}. The guard middleware rejects missing-token submits with a stable error-code before the verify branch runs. The event record is Object.frozen at the boundary so no downstream handler enriches it with a stray token slice.",
+  "interfaces": [
+    {
+      "name": "createTurnstileVerifier",
+      "kind": "factory",
+      "summary": "Turnstile server-side verifier over env.TURNSTILE_SECRET."
+    },
+    {
+      "name": "verifier.verify",
+      "kind": "method",
+      "summary": "POST {secret, response} to siteverify; returns {success, errorCodes}."
+    },
+    {
+      "name": "verifier.guard",
+      "kind": "method",
+      "summary": "Middleware that reads Cf-Turnstile-Response and rejects missing-token submits with 400."
+    }
+  ],
+  "dependencies": [],
+  "createdAt": "2026-09-07T20:00:00.000Z",
+  "updatedAt": "2026-09-07T20:00:00.000Z"
+}

package/blueprints/edge-cloudflare-turnstile/contributions/tacs/tac-3603-edge-cloudflare-turnstile-magic-link-hook.json

@@ -0,0 +1,25 @@
+{
+  "tacId": "TAC-3603-edge-cloudflare-turnstile-magic-link-hook",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "name": "Composition hook into security-auth-magic-link mint surface",
+  "purpose": "When security-auth-magic-link is applied alongside edge-cloudflare-turnstile, this hook registers the magic-link mint route under the Turnstile guard so a mint submit reads through the same token check. A missing or failed Turnstile response refuses the mint with 400 before the mint fires (AC-35105-1, AC-35105-2).",
+  "responsibilities": [
+    "Register the magic-link mint route under the Turnstile guard at composition apply time.",
+    "Refuse a mint submit without a valid Turnstile token with 400 before the mint fires.",
+    "Emit a mint-refused event record with the same {sitekeyHash, outcome, timestamp} shape as any other guard refusal."
+  ],
+  "internalStructure": "A thin registration hook that wraps the shipped magic-link mint handler with the Turnstile guard middleware. In the pack fixture the wiring is a one-line composeWithMagicLink({guard, mintHandler}) invocation on the route registration.",
+  "interfaces": [
+    {
+      "name": "composeWithMagicLink",
+      "kind": "function",
+      "summary": "Register the magic-link mint route under the Turnstile guard."
+    }
+  ],
+  "dependencies": [],
+  "createdAt": "2026-09-07T20:00:00.000Z",
+  "updatedAt": "2026-09-07T20:00:00.000Z"
+}

package/blueprints/edge-cloudflare-turnstile/contributions/user-stories/edge-cloudflare-turnstile-us-35101.json

@@ -0,0 +1,27 @@
+{
+  "usId": "edge-cloudflare-turnstile-US-35101",
+  "prdId": "PRD-001",
+  "reqId": "edge-cloudflare-turnstile-REQ-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Turnstile client widget mounts with the elicited sitekey and injects no third-party script beyond the Cloudflare Turnstile host",
+  "asA": "shelf consumer applying the edge-cloudflare-turnstile v1.0.0 blueprint on a Workers project using the probe-pack-edge-cloudflare-turnstile fixture",
+  "iWant": "the Turnstile widget to mount on my public form with the elicited TURNSTILE_SITEKEY, to inject only Cloudflare Turnstile JS and no other third-party script, and to populate the hidden Cf-Turnstile-Response token field on submit",
+  "soThat": "every submit that reaches my server carries a Turnstile response my server-side verifier can check and the browser has loaded no scripts I did not authorise",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-35101-1",
+      "description": "When the fixture page loads with the pinned always-pass test sitekey (1x00000000000000000000AA per https://developers.cloudflare.com/turnstile/troubleshooting/testing/), the Turnstile widget mounts and an iframe whose src origin is https://challenges.cloudflare.com is present; the page loads no third-party script from any other origin; the form payload on submit carries a non-empty Cf-Turnstile-Response value.",
+      "given": "the pack fixture form loaded with default sitekey=pass and the pinned always-pass test sitekey applied",
+      "when": "the widget renders and the operator submits",
+      "then": "the Turnstile widget is mounted, its iframe origin is Cloudflare Turnstile only, and the submit payload contains the Cf-Turnstile-Response token",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3601-edge-cloudflare-turnstile-widget-mount"
+  ],
+  "createdAt": "2026-09-07T20:00:00.000Z",
+  "updatedAt": "2026-09-07T20:00:00.000Z"
+}