rcf-lite 0.22.0 → 0.24.0

package/blueprints/application-notifications-in-app/docs/topics.md

@@ -21,7 +21,7 @@ The `application-notifications-` prefix is reserved for the sibling channel blue
 | application-charts | 18101-18899 | 19xx | shipped v1.0.0 | none |
 | application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
 | application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
-| application-admin-console | 21101-21899 | 22xx | shipped v1.0.0 | none |
+| application-admin-console | 21101-21899 | 22xx | shipped v1.1.0 | `adminConsoleSignInSurface` |
 | application-empty-error-states | 22101-22899 | 23xx | shipped v1.0.0 | none |
 | application-file-upload | 23101-23899 | 24xx | shipped v1.0.0 | none |
 | application-forms-wizard | 24101-24899 | 25xx | shipped v1.0.0 | none |
@@ -29,6 +29,14 @@ The `application-notifications-` prefix is reserved for the sibling channel blue
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
 | object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
+| jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
+| platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
+| platform-cloudflare-cron-triggers | 32101-32899 | 33xx | shipped v1.0.0 | `scheduledTriggerContract` |
+| platform-cloudflare-durable-objects | 33101-33899 | 34xx | shipped v1.0.0 | `strongConsistencyCellContract`, `websocketHubContract` |
+| edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
+| edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
+| edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
 | application-notifications-email (reserved) | to be claimed at ship | to be claimed at ship | name-only doc reservation (not shipped) | tba |
 | application-notifications-push (reserved) | to be claimed at ship | to be claimed at ship | name-only doc reservation (not shipped) | tba |
 | application-notifications-webhook (reserved) | to be claimed at ship | to be claimed at ship | name-only doc reservation (not shipped) | tba |

package/blueprints/application-onboarding-tour/docs/topics.md

@@ -17,7 +17,7 @@ The blueprint claims no new global topics at v1.0.0. Onboarding-tour is a consum
 | application-charts | 18101-18899 | 19xx | shipped v1.0.0 | none |
 | application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
 | application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
-| application-admin-console | 21101-21899 | 22xx | shipped v1.0.0 | none |
+| application-admin-console | 21101-21899 | 22xx | shipped v1.1.0 | `adminConsoleSignInSurface` |
 | application-empty-error-states | 22101-22899 | 23xx | shipped v1.0.0 | none |
 | application-file-upload | 23101-23899 | 24xx | shipped v1.0.0 | none |
 | application-forms-wizard | 24101-24899 | 25xx | shipped v1.0.0 | none |
@@ -25,6 +25,14 @@ The blueprint claims no new global topics at v1.0.0. Onboarding-tour is a consum
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
 | object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
+| jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
+| platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
+| platform-cloudflare-cron-triggers | 32101-32899 | 33xx | shipped v1.0.0 | `scheduledTriggerContract` |
+| platform-cloudflare-durable-objects | 33101-33899 | 34xx | shipped v1.0.0 | `strongConsistencyCellContract`, `websocketHubContract` |
+| edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
+| edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
+| edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
 
 The shelf-wide band registry lives in `packages/rcf-lite/docs/blueprint-authoring.md` section 5.
 

package/blueprints/application-spa/docs/topics.md

@@ -38,7 +38,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | security-auth-clerk | 9101-9899 | 10xx | shipped v1.0.0 | `authModel` |
 | security-auth-oauth2 | 10101-10899 | 11xx | shipped v1.0.0 | `authModel` |
 | security-auth-keycloak | 11101-11899 | 12xx | shipped v1.0.0 | `authModel` |
-| deploy-cloudflare-workers | 12101-12899 | 13xx | shipped v1.0.0 | `deploymentTarget` |
+| deploy-cloudflare-workers | 12101-12899 | 13xx | shipped v1.2.0 | `deploymentTarget` |
 | persistence-data-d1 | 13101-13899 | 14xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
 | observability-probe-endpoints | 14101-14899 | 15xx | shipped v1.1.0 | `healthProbes`, `readinessSemantics` |
 | observability-logging | 15101-15899 | 16xx | shipped v1.0.0 | `logging` |
@@ -47,7 +47,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | application-charts | 18101-18899 | 19xx | shipped v1.0.0 | none |
 | application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
 | application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
-| application-admin-console | 21101-21899 | 22xx | shipped v1.0.0 | none |
+| application-admin-console | 21101-21899 | 22xx | shipped v1.1.0 | `adminConsoleSignInSurface` |
 | application-empty-error-states | 22101-22899 | 23xx | shipped v1.0.0 | none |
 | application-file-upload | 23101-23899 | 24xx | shipped v1.0.0 | none |
 | application-forms-wizard | 24101-24899 | 25xx | shipped v1.0.0 | none |
@@ -55,6 +55,14 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
 | object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
+| jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
+| platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
+| platform-cloudflare-cron-triggers | 32101-32899 | 33xx | shipped v1.0.0 | `scheduledTriggerContract` |
+| platform-cloudflare-durable-objects | 33101-33899 | 34xx | shipped v1.0.0 | `strongConsistencyCellContract`, `websocketHubContract` |
+| edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
+| edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
+| edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
 
 SPA v1.1.0 stays on the LOW end of its band: v1.0.0 occupied US-1101 through US-1128; v1.1.0 adds US-1129 and US-1130, leaving headroom above 1130 for future minor bumps and for project-side stories that mechanically derive to the 11xx numeric range.
 

package/blueprints/delivery-ci-workflows/docs/topics.md

@@ -53,7 +53,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | application-charts | 18101-18899 | 19xx | shipped v1.0.0 | none |
 | application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
 | application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
-| application-admin-console | 21101-21899 | 22xx | shipped v1.0.0 | none |
+| application-admin-console | 21101-21899 | 22xx | shipped v1.1.0 | `adminConsoleSignInSurface` |
 | application-empty-error-states | 22101-22899 | 23xx | shipped v1.0.0 | none |
 | application-file-upload | 23101-23899 | 24xx | shipped v1.0.0 | none |
 | application-forms-wizard | 24101-24899 | 25xx | shipped v1.0.0 | none |
@@ -61,6 +61,14 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
 | object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
+| jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
+| platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
+| platform-cloudflare-cron-triggers | 32101-32899 | 33xx | shipped v1.0.0 | `scheduledTriggerContract` |
+| platform-cloudflare-durable-objects | 33101-33899 | 34xx | shipped v1.0.0 | `strongConsistencyCellContract`, `websocketHubContract` |
+| edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
+| edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
+| edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
 
 US 6101-6110 sit at the LOW end of the 6101-6899 band on purpose. A project-side story that mechanically derives from `delivery-ci-workflows-REQ-011` into the number `6111` would collide against delivery-ci-workflows-US-6111 in this package; the band leaves headroom at the HIGH end (US 6181-6899) so a project's own stories anchored to delivery-ci-workflows REQs can allocate without conflict. The watchpost run4 lesson applies here too.
 

package/blueprints/deploy-cloudflare-workers/CHANGELOG.md

@@ -0,0 +1,69 @@
+# Changelog
+
+All notable changes to the `deploy-cloudflare-workers` blueprint are recorded here.
+The format follows Keep a Changelog. Versions are semver, per
+`packages/rcf-lite/docs/blueprint-authoring.md` section 6.
+
+## 1.2.0 - 2026-09-07
+
+Additive minor bump. Blesses the Workers-with-static-assets shape as the
+ratified SPA-on-Workers deploy shape, per the Cloudflare Pages
+landing-page recommendation (2026-09-06). Seven new contributions in the
+existing 12xx US band and 13xx suffix block; every shipped v1.1.0
+contribution carries through unchanged.
+
+Added
+
+- REQ `deploy-cloudflare-workers-REQ-013`: Workers-with-static-assets
+  shape. An elicited `[assets] directory` value is emitted on
+  `wrangler.toml`; the manifest never carries `pages_build_output_dir`
+  alongside `[assets]`.
+- REQ `deploy-cloudflare-workers-REQ-014`: SPA fallback discipline via
+  elicited `run_worker_first`. A truthy answer emits
+  `run_worker_first = true` under `[assets]`; a falsy or unanswered
+  answer omits the field and lets Cloudflare's runtime serve assets
+  before the Worker fetch handler runs.
+- US `-US-12113`: SPA-on-Workers deploy. Runtime-observable ACs on the
+  emitted `[assets]` block shape.
+- US `-US-12114`: assets-directory elicitation. Recorded on the applied
+  sidecar as `appliedElicitations.assets-directory`.
+- US `-US-12115`: migrate-from-Pages guidance. Guide section links
+  Cloudflare's own migrate-from-Pages walkthrough.
+- ADR `ADR-1306-deploy-cloudflare-workers-spa-shape`: Workers-with-
+  static-assets as the ratified SPA-on-Workers deploy shape.
+  Contribution entry carries `recommendedDefault: true` and
+  `standardsTraceClause: Cloudflare Pages landing-page recommendation
+  (2026-09-06)`. Body quotes the landing-page recommendation verbatim
+  (fetched 2026-09-06 in the round-6 proposal and re-verified at
+  ratification).
+- Elicits (top-level `elicits[]`): `assets-directory` (string, default
+  empty) and `run-worker-first` (boolean, default false). The spec's
+  intended `when: {elicitedNonEmpty: [assets-directory]}` predicate on
+  `run-worker-first` is not shipped this round because the loader's
+  supported `when` block only accepts `requiresCapability` arrays; the
+  guide teaches that `run-worker-first` is only meaningful when
+  `assets-directory` is non-empty.
+- Probe module `contributions/probes/assets-manifest-scan.mjs`
+  (`anchorAcId: AC-12113-1`, `accountBound: false`): parses the applied
+  fixture `wrangler.toml`, asserts `[assets] directory` matches the
+  elicited answer, asserts `run_worker_first` matches the elicited
+  answer, and refuses on any `pages_build_output_dir` presence.
+
+Changed
+
+- Existing ADR contribution entries (`ADR-1301` through `ADR-1305`)
+  gain the `generic enterprise practice` sentinel on
+  `standardsTraceClause` at the contribution entry, per
+  `blueprint-authoring.md` section 8a.4. The ADR bodies are not touched.
+
+Notes
+
+- No new capability minted; `capabilities` remains absent.
+- No new global topic minted; the existing `deploymentTarget` topic on
+  ADR-1301 covers the deploy shape unchanged.
+- No runtime dependency added to applying projects.
+- `suggestedCompanions` unchanged (`logging`, `errorHandling`).
+- The shared `cf-platform` sample-app fixture at
+  `packages/rcf-lite/test/fixtures/cf-platform/` ships alongside this
+  bump as the probe target. T-1 (KV), T-2 (cron), T-3 (Durable Objects)
+  and T-5's Turnstile sub-fixture extend the same fixture later.

package/blueprints/deploy-cloudflare-workers/README.md

@@ -44,6 +44,18 @@ See `docs/topics.md` for the exact strings, the expected resolutions, the deline
 
 Repo-root wrangler manifest as the sole declaration of Worker name, entry, compatibility settings, and every binding; one Deploy Adapter as the sole caller of the vendor CLI on the boundary; every merge to main uploads a Worker version reachable at both a permanent per-version-id URL and a stable preview alias URL; the uploaded version never serves production traffic; production only changes when the `promote` workflow runs on an explicit operator trigger; the promote workflow accepts one input `versionId` (empty defaults to newest-of-main); rollback IS a promote of a prior version id, on the same workflow, with the same audit shape; every promote runs the Served-surface Verifier against the production URL with bounded retries; a promote whose verifier fails is not marked successful; every uploaded version carries build provenance (commit sha, build timestamp, CI run URL) readable at a fixed health-probe path; the health probe's `versionSha` field is the served-surface verifier's confirmation that the promoted version is the version being served; no secret value ever lives in the wrangler manifest, in a committed environment file, in a CI variable readable outside the promote job, or in any CI log line; a probe against a dev-mode local URL is refused as coverage for a `deployed`-scope AC; the manifest loader refuses a wrangler config whose production route resolves to the same host as the preview alias URL. Every bar is carried by ACs in the doc set, not by this README.
 
+## What v1.2.0 adds
+
+v1.2.0 is an additive-minor bump. Every shipped v1.1.0 contribution carries through unchanged; the compose invocation is identical (`rcf define blueprint add <path-to>/blueprints/deploy-cloudflare-workers` unchanged); no capability minted; no new global topic; no runtime dependency added; `suggestedCompanions` unchanged (`logging`, `errorHandling`). The bump blesses the Workers-with-static-assets shape as the ratified SPA-on-Workers deploy shape, per the Cloudflare Pages landing-page recommendation (fetched 2026-09-06, verbatim quote on `ADR-1306`).
+
+- **Workers-with-static-assets shape (`REQ-013`, `REQ-014`).** Two new REQs cover the `[assets] directory` block on `wrangler.toml` and the SPA fallback discipline via `run_worker_first`. Three new USs in the existing 12xx band (`US-12113` SPA-on-Workers deploy, `US-12114` assets-directory elicitation, `US-12115` migrate-from-Pages guidance) bind the runtime-observable ACs to `TAC-1302-deploy-cloudflare-workers-wrangler-manifest`.
+- **Ratified shape decision (`ADR-1306-deploy-cloudflare-workers-spa-shape`).** Body carries the Cloudflare landing-page quote verbatim; the contribution entry carries `recommendedDefault: true` and `standardsTraceClause: Cloudflare Pages landing-page recommendation (2026-09-06)` per `blueprint-authoring.md` section 8a.2. The ADR names a project-level supersede path for projects that keep the bare-Worker shape or stay on Pages.
+- **Two new elicits.** `assets-directory` (kind `string`, default empty) picks the static-assets root; `run-worker-first` (kind `boolean`, default `false`) picks the SPA fallback discipline. The loader-side `when-elicitedNonEmpty` predicate the spec calls for is a mechanism follow-up, so `run-worker-first` fires unconditionally in v1.2.0; the guide teaches that the elicit is only meaningful when `assets-directory` is non-empty.
+- **Probe module (`contributions/probes/assets-manifest-scan.mjs`).** `accountBound: false`, `anchorAcId: AC-12113-1`. Source-tree parser reads the applied fixture's `wrangler.toml` and asserts the `[assets]` shape against the elicited answers; refuses on `pages_build_output_dir` presence anywhere on the manifest (the Workers-with-static-assets shape and the Pages shape are mutually exclusive per the Cloudflare static-assets doc).
+- **Shared sample-app fixture (`packages/rcf-lite/test/fixtures/cf-platform/`).** T-0 mints the fixture; T-1 (KV), T-2 (cron), T-3 (Durable Objects) and T-5's Turnstile sub-fixture extend it later. Ships `wrangler.toml` with the ratified `[assets]` block, `dist/index.html`, a minimal `src/index.mjs` Worker entry, `package.json` with `wrangler` as a devDependency and `wrangler dev` as the start script, a `run-assets-manifest-scan.mjs` shim wiring the probe against the fixture, and a `README.md` naming the manual `wrangler dev` boot line and the two induced-failure switches (`SIMULATE_MIXED_SHAPE`, `SIMULATE_EMPTY_ASSETS`). The fixture never binds port 4200.
+
+A project on v1.1.0 picks up v1.2.0 with the same compose invocation; a fresh apply on a project answering both elicits reads the applied sidecar at `rcf/blueprints/deploy-cloudflare-workers.applied.json`. A project on Pages that wants to migrate reads the guide's new `Workers-with-static-assets: the SPA-on-Workers shape` section for the Cloudflare migrate-from-Pages link.
+
 ## What v1.1.0 adds
 
 v1.1.0 is an additive-non-global minor bump. No global topics change; no contribution is removed; the compose invocation is unchanged. The bump cures seven content findings that the round-2 dogfood acceptance build surfaced when a stranger followed the v1.0.0 teaching against wrangler 4.x reality (three HIGH, three MEDIUM, one LOW). Every fixed teaching is execution-verified against the shipped vendor CLI, with one depth-stop caveat: the bootstrap flow taught in `assets/wrangler-samples/bootstrap-vs-steady-state.md` (F-006) is composed from vendor CLI refusals reproduced against a real Worker (the three refusal-message excerpts in the asset are byte-verified against the shipped CLI's output) and each individual vendor primitive it composes is verified in isolation, but the composed `wrangler deploy --secrets-file <tmp>` bootstrap sequence itself is not end-to-end executed as a single verified run in this ship. A project applying the blueprint exercises the composed sequence the first time it bootstraps a Worker.

package/blueprints/deploy-cloudflare-workers/blueprint.json

@@ -1,48 +1,246 @@
 {
   "slug": "deploy-cloudflare-workers",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "category": "deploy",
   "contributions": [
-    { "id": "deploy-cloudflare-workers-REQ-001", "kind": "req", "path": "requirements/deploy-cloudflare-workers-req-001.json" },
-    { "id": "deploy-cloudflare-workers-REQ-002", "kind": "req", "path": "requirements/deploy-cloudflare-workers-req-002.json" },
-    { "id": "deploy-cloudflare-workers-REQ-003", "kind": "req", "path": "requirements/deploy-cloudflare-workers-req-003.json" },
-    { "id": "deploy-cloudflare-workers-REQ-004", "kind": "req", "path": "requirements/deploy-cloudflare-workers-req-004.json" },
-    { "id": "deploy-cloudflare-workers-REQ-005", "kind": "req", "path": "requirements/deploy-cloudflare-workers-req-005.json" },
-    { "id": "deploy-cloudflare-workers-REQ-006", "kind": "req", "path": "requirements/deploy-cloudflare-workers-req-006.json" },
-    { "id": "deploy-cloudflare-workers-REQ-007", "kind": "req", "path": "requirements/deploy-cloudflare-workers-req-007.json" },
-    { "id": "deploy-cloudflare-workers-REQ-008", "kind": "req", "path": "requirements/deploy-cloudflare-workers-req-008.json" },
-    { "id": "deploy-cloudflare-workers-REQ-009", "kind": "req", "path": "requirements/deploy-cloudflare-workers-req-009.json" },
-    { "id": "deploy-cloudflare-workers-REQ-010", "kind": "req", "path": "requirements/deploy-cloudflare-workers-req-010.json" },
-    { "id": "deploy-cloudflare-workers-REQ-011", "kind": "req", "path": "requirements/deploy-cloudflare-workers-req-011.json" },
-    { "id": "deploy-cloudflare-workers-REQ-012", "kind": "req", "path": "requirements/deploy-cloudflare-workers-req-012.json" },
-    { "id": "deploy-cloudflare-workers-US-12101", "kind": "us", "path": "user-stories/deploy-cloudflare-workers-us-12101.json" },
-    { "id": "deploy-cloudflare-workers-US-12102", "kind": "us", "path": "user-stories/deploy-cloudflare-workers-us-12102.json" },
-    { "id": "deploy-cloudflare-workers-US-12103", "kind": "us", "path": "user-stories/deploy-cloudflare-workers-us-12103.json" },
-    { "id": "deploy-cloudflare-workers-US-12104", "kind": "us", "path": "user-stories/deploy-cloudflare-workers-us-12104.json" },
-    { "id": "deploy-cloudflare-workers-US-12105", "kind": "us", "path": "user-stories/deploy-cloudflare-workers-us-12105.json" },
-    { "id": "deploy-cloudflare-workers-US-12106", "kind": "us", "path": "user-stories/deploy-cloudflare-workers-us-12106.json" },
-    { "id": "deploy-cloudflare-workers-US-12107", "kind": "us", "path": "user-stories/deploy-cloudflare-workers-us-12107.json" },
-    { "id": "deploy-cloudflare-workers-US-12108", "kind": "us", "path": "user-stories/deploy-cloudflare-workers-us-12108.json" },
-    { "id": "deploy-cloudflare-workers-US-12109", "kind": "us", "path": "user-stories/deploy-cloudflare-workers-us-12109.json" },
-    { "id": "deploy-cloudflare-workers-US-12110", "kind": "us", "path": "user-stories/deploy-cloudflare-workers-us-12110.json" },
-    { "id": "deploy-cloudflare-workers-US-12111", "kind": "us", "path": "user-stories/deploy-cloudflare-workers-us-12111.json" },
-    { "id": "deploy-cloudflare-workers-US-12112", "kind": "us", "path": "user-stories/deploy-cloudflare-workers-us-12112.json" },
-    { "id": "TAC-1301-deploy-cloudflare-workers-deploy-adapter", "kind": "tac", "path": "tacs/tac-1301-deploy-cloudflare-workers-deploy-adapter.json" },
-    { "id": "TAC-1302-deploy-cloudflare-workers-wrangler-manifest", "kind": "tac", "path": "tacs/tac-1302-deploy-cloudflare-workers-wrangler-manifest.json" },
-    { "id": "TAC-1303-deploy-cloudflare-workers-preview-url-resolver", "kind": "tac", "path": "tacs/tac-1303-deploy-cloudflare-workers-preview-url-resolver.json" },
-    { "id": "TAC-1304-deploy-cloudflare-workers-promote-gate", "kind": "tac", "path": "tacs/tac-1304-deploy-cloudflare-workers-promote-gate.json" },
-    { "id": "TAC-1305-deploy-cloudflare-workers-served-surface-verifier", "kind": "tac", "path": "tacs/tac-1305-deploy-cloudflare-workers-served-surface-verifier.json" },
-    { "id": "TAC-1306-deploy-cloudflare-workers-deploy-ci-workflows", "kind": "tac", "path": "tacs/tac-1306-deploy-cloudflare-workers-deploy-ci-workflows.json" },
+    {
+      "id": "deploy-cloudflare-workers-REQ-001",
+      "kind": "req",
+      "path": "requirements/deploy-cloudflare-workers-req-001.json"
+    },
+    {
+      "id": "deploy-cloudflare-workers-REQ-002",
+      "kind": "req",
+      "path": "requirements/deploy-cloudflare-workers-req-002.json"
+    },
+    {
+      "id": "deploy-cloudflare-workers-REQ-003",
+      "kind": "req",
+      "path": "requirements/deploy-cloudflare-workers-req-003.json"
+    },
+    {
+      "id": "deploy-cloudflare-workers-REQ-004",
+      "kind": "req",
+      "path": "requirements/deploy-cloudflare-workers-req-004.json"
+    },
+    {
+      "id": "deploy-cloudflare-workers-REQ-005",
+      "kind": "req",
+      "path": "requirements/deploy-cloudflare-workers-req-005.json"
+    },
+    {
+      "id": "deploy-cloudflare-workers-REQ-006",
+      "kind": "req",
+      "path": "requirements/deploy-cloudflare-workers-req-006.json"
+    },
+    {
+      "id": "deploy-cloudflare-workers-REQ-007",
+      "kind": "req",
+      "path": "requirements/deploy-cloudflare-workers-req-007.json"
+    },
+    {
+      "id": "deploy-cloudflare-workers-REQ-008",
+      "kind": "req",
+      "path": "requirements/deploy-cloudflare-workers-req-008.json"
+    },
+    {
+      "id": "deploy-cloudflare-workers-REQ-009",
+      "kind": "req",
+      "path": "requirements/deploy-cloudflare-workers-req-009.json"
+    },
+    {
+      "id": "deploy-cloudflare-workers-REQ-010",
+      "kind": "req",
+      "path": "requirements/deploy-cloudflare-workers-req-010.json"
+    },
+    {
+      "id": "deploy-cloudflare-workers-REQ-011",
+      "kind": "req",
+      "path": "requirements/deploy-cloudflare-workers-req-011.json"
+    },
+    {
+      "id": "deploy-cloudflare-workers-REQ-012",
+      "kind": "req",
+      "path": "requirements/deploy-cloudflare-workers-req-012.json"
+    },
+    {
+      "id": "deploy-cloudflare-workers-US-12101",
+      "kind": "us",
+      "path": "user-stories/deploy-cloudflare-workers-us-12101.json"
+    },
+    {
+      "id": "deploy-cloudflare-workers-US-12102",
+      "kind": "us",
+      "path": "user-stories/deploy-cloudflare-workers-us-12102.json"
+    },
+    {
+      "id": "deploy-cloudflare-workers-US-12103",
+      "kind": "us",
+      "path": "user-stories/deploy-cloudflare-workers-us-12103.json"
+    },
+    {
+      "id": "deploy-cloudflare-workers-US-12104",
+      "kind": "us",
+      "path": "user-stories/deploy-cloudflare-workers-us-12104.json"
+    },
+    {
+      "id": "deploy-cloudflare-workers-US-12105",
+      "kind": "us",
+      "path": "user-stories/deploy-cloudflare-workers-us-12105.json"
+    },
+    {
+      "id": "deploy-cloudflare-workers-US-12106",
+      "kind": "us",
+      "path": "user-stories/deploy-cloudflare-workers-us-12106.json"
+    },
+    {
+      "id": "deploy-cloudflare-workers-US-12107",
+      "kind": "us",
+      "path": "user-stories/deploy-cloudflare-workers-us-12107.json"
+    },
+    {
+      "id": "deploy-cloudflare-workers-US-12108",
+      "kind": "us",
+      "path": "user-stories/deploy-cloudflare-workers-us-12108.json"
+    },
+    {
+      "id": "deploy-cloudflare-workers-US-12109",
+      "kind": "us",
+      "path": "user-stories/deploy-cloudflare-workers-us-12109.json"
+    },
+    {
+      "id": "deploy-cloudflare-workers-US-12110",
+      "kind": "us",
+      "path": "user-stories/deploy-cloudflare-workers-us-12110.json"
+    },
+    {
+      "id": "deploy-cloudflare-workers-US-12111",
+      "kind": "us",
+      "path": "user-stories/deploy-cloudflare-workers-us-12111.json"
+    },
+    {
+      "id": "deploy-cloudflare-workers-US-12112",
+      "kind": "us",
+      "path": "user-stories/deploy-cloudflare-workers-us-12112.json"
+    },
+    {
+      "id": "TAC-1301-deploy-cloudflare-workers-deploy-adapter",
+      "kind": "tac",
+      "path": "tacs/tac-1301-deploy-cloudflare-workers-deploy-adapter.json"
+    },
+    {
+      "id": "TAC-1302-deploy-cloudflare-workers-wrangler-manifest",
+      "kind": "tac",
+      "path": "tacs/tac-1302-deploy-cloudflare-workers-wrangler-manifest.json"
+    },
+    {
+      "id": "TAC-1303-deploy-cloudflare-workers-preview-url-resolver",
+      "kind": "tac",
+      "path": "tacs/tac-1303-deploy-cloudflare-workers-preview-url-resolver.json"
+    },
+    {
+      "id": "TAC-1304-deploy-cloudflare-workers-promote-gate",
+      "kind": "tac",
+      "path": "tacs/tac-1304-deploy-cloudflare-workers-promote-gate.json"
+    },
+    {
+      "id": "TAC-1305-deploy-cloudflare-workers-served-surface-verifier",
+      "kind": "tac",
+      "path": "tacs/tac-1305-deploy-cloudflare-workers-served-surface-verifier.json"
+    },
+    {
+      "id": "TAC-1306-deploy-cloudflare-workers-deploy-ci-workflows",
+      "kind": "tac",
+      "path": "tacs/tac-1306-deploy-cloudflare-workers-deploy-ci-workflows.json"
+    },
     {
       "id": "ADR-1301-deploy-cloudflare-workers-deployment-target",
       "kind": "adr",
       "path": "adrs/adr-1301-deploy-cloudflare-workers-deployment-target.json",
       "scope": "global",
-      "topic": "deploymentTarget"
+      "topic": "deploymentTarget",
+      "standardsTraceClause": "generic enterprise practice"
+    },
+    {
+      "id": "ADR-1302-deploy-cloudflare-workers-default-vendor",
+      "kind": "adr",
+      "path": "adrs/adr-1302-deploy-cloudflare-workers-default-vendor.json",
+      "standardsTraceClause": "generic enterprise practice"
     },
-    { "id": "ADR-1302-deploy-cloudflare-workers-default-vendor", "kind": "adr", "path": "adrs/adr-1302-deploy-cloudflare-workers-default-vendor.json" },
-    { "id": "ADR-1303-deploy-cloudflare-workers-preview-vs-production", "kind": "adr", "path": "adrs/adr-1303-deploy-cloudflare-workers-preview-vs-production.json" },
-    { "id": "ADR-1304-deploy-cloudflare-workers-rollback-is-promote", "kind": "adr", "path": "adrs/adr-1304-deploy-cloudflare-workers-rollback-is-promote.json" },
-    { "id": "ADR-1305-deploy-cloudflare-workers-dev-mode-drift", "kind": "adr", "path": "adrs/adr-1305-deploy-cloudflare-workers-dev-mode-drift.json" }
+    {
+      "id": "ADR-1303-deploy-cloudflare-workers-preview-vs-production",
+      "kind": "adr",
+      "path": "adrs/adr-1303-deploy-cloudflare-workers-preview-vs-production.json",
+      "standardsTraceClause": "generic enterprise practice"
+    },
+    {
+      "id": "ADR-1304-deploy-cloudflare-workers-rollback-is-promote",
+      "kind": "adr",
+      "path": "adrs/adr-1304-deploy-cloudflare-workers-rollback-is-promote.json",
+      "standardsTraceClause": "generic enterprise practice"
+    },
+    {
+      "id": "ADR-1305-deploy-cloudflare-workers-dev-mode-drift",
+      "kind": "adr",
+      "path": "adrs/adr-1305-deploy-cloudflare-workers-dev-mode-drift.json",
+      "standardsTraceClause": "generic enterprise practice"
+    },
+    {
+      "id": "deploy-cloudflare-workers-REQ-013",
+      "kind": "req",
+      "path": "requirements/deploy-cloudflare-workers-req-013.json"
+    },
+    {
+      "id": "deploy-cloudflare-workers-REQ-014",
+      "kind": "req",
+      "path": "requirements/deploy-cloudflare-workers-req-014.json"
+    },
+    {
+      "id": "deploy-cloudflare-workers-US-12113",
+      "kind": "us",
+      "path": "user-stories/deploy-cloudflare-workers-us-12113.json"
+    },
+    {
+      "id": "deploy-cloudflare-workers-US-12114",
+      "kind": "us",
+      "path": "user-stories/deploy-cloudflare-workers-us-12114.json"
+    },
+    {
+      "id": "deploy-cloudflare-workers-US-12115",
+      "kind": "us",
+      "path": "user-stories/deploy-cloudflare-workers-us-12115.json"
+    },
+    {
+      "id": "ADR-1306-deploy-cloudflare-workers-spa-shape",
+      "kind": "adr",
+      "path": "adrs/adr-1306-deploy-cloudflare-workers-spa-shape.json",
+      "recommendedDefault": true,
+      "elicited": false,
+      "standardsTraceClause": "Cloudflare Pages landing-page recommendation (2026-09-06)"
+    }
+  ],
+  "elicits": [
+    {
+      "id": "assets-directory",
+      "prompt": "Assets directory: the path (relative to the Worker source root) whose files Cloudflare serves at the edge as static assets under the Workers-with-static-assets shape. An empty answer keeps the bare-Worker shape (no [assets] block on the generated wrangler.toml). A non-empty answer emits [assets] directory = the answered path.",
+      "kind": "string",
+      "default": ""
+    },
+    {
+      "id": "run-worker-first",
+      "prompt": "Run Worker first: whether the Worker fetch handler runs BEFORE static asset lookup for every request. True emits run_worker_first = true under the [assets] block (right for a SPA whose Worker owns arbitrary routing or whose auth middleware must gate every path). False (default) omits the field and lets Cloudflare's runtime serve a matching static asset before the Worker runs. Only meaningful when assets-directory is non-empty; the loader-side when-elicitedNonEmpty predicate is a mechanism follow-up.",
+      "kind": "boolean",
+      "default": false
+    }
+  ],
+  "suggestedCompanions": [
+    {
+      "role": "logging",
+      "reason": "Every promote and every served-surface verify writes a structured deploy log record and a probe verdict; a logging companion supplies the record factory the deploy adapter and the verifier both call."
+    },
+    {
+      "role": "errorHandling",
+      "reason": "A promote refusal (bad version id, verifier fail, mixed-shape wrangler manifest) constructs an internal error record; an error-handling companion supplies the record factory and the boundary at which the deploy adapter's refusals surface to the operator."
+    }
   ]
 }

package/blueprints/deploy-cloudflare-workers/contributions/adrs/adr-1306-deploy-cloudflare-workers-spa-shape.json

@@ -0,0 +1,30 @@
+{
+  "adrId": "ADR-1306-deploy-cloudflare-workers-spa-shape",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.2.0",
+  "status": "accepted",
+  "title": "Workers-with-static-assets is the ratified SPA-on-Workers deploy shape; Pages is a documented alternative held for legacy projects only",
+  "context": "Cloudflare ships two shapes for browsing static assets in front of a Workers-tier deploy target: Cloudflare Pages (a workflow-shaped product with its own build pipeline and its own preview URL model) and Workers-with-static-assets (a wrangler.toml [assets] block declaring a directory the Cloudflare runtime serves at the edge). Cloudflare's own Pages landing page states, verbatim (fetched 2026-09-06): 'Workers supports most Pages use cases and offers a broader feature set. It is Cloudflare's primary platform for building applications. Start new projects with Workers.' The prior v1.1.0 blueprint blessed neither shape as the default; v1.1.0 taught the wrangler [assets] block in an asset sample but left the shape choice implicit. The T-0 round bumps the blueprint to v1.2.0 to close the gap: a rcf-lite project choosing SPA-on-Workers gets a single, ratified wrangler shape rather than a hand-rolled convention, and the ratified shape follows Cloudflare's own recommendation for new projects.",
+  "decision": "The blueprint blesses Workers-with-static-assets as the ratified SPA-on-Workers deploy shape (recommendedDefault true for new SPA projects). A project answering the elicited assets-directory parameter with a non-empty path emits an [assets] block on wrangler.toml whose directory value carries the elicited path; a project answering with an empty path keeps the bare-Worker shape (no [assets] block). The elicited run-worker-first (boolean, default false) surfaces the SPA fallback discipline: truthy answers emit run_worker_first = true under the [assets] block; falsy or unanswered answers omit the field, letting Cloudflare's runtime run asset lookup before the Worker fetch handler. The blueprint does not mint a Cloudflare Pages blueprint; a future deploy-cloudflare-pages-legacy sibling mints on demand only if a project cannot make the jump. Every existing v1.1.0 contribution carries through unchanged.",
+  "consequences": "One ratified shape lands on the shelf for greenfield SPA-on-Workers projects; the shape's standards trace is the Cloudflare Pages landing-page recommendation (2026-09-06 snapshot). The two new elicits become part of the operator surface at blueprint add: assets-directory names the static-assets root, run-worker-first names the SPA fallback discipline. A project generating both an [assets] block and a Pages-only pages_build_output_dir field is a mixed-shape drift the T-0 probe (assets-manifest-scan.mjs) refuses. A project on the legacy Pages shape stays on v1.1.0 semantics until it migrates; the guide's new Workers-with-static-assets section links Cloudflare's migrate-from-Pages walkthrough for projects that choose to jump. Future round-6 blueprints (T-1 KV, T-2 cron, T-3 DO, T-4 Access, T-5 Turnstile, T-6 rate-limiting) all compose on this shape via the shared cf-platform sample-app fixture.",
+  "alternativesConsidered": [
+    {
+      "name": "Ship a Cloudflare Pages blueprint alongside deploy-cloudflare-workers",
+      "summary": "Mint a fresh deploy-cloudflare-pages blueprint that owns the Pages workflow surface (build pipeline, preview URLs, deploy hooks) and lets the operator pick shapes at apply.",
+      "reasonNotChosen": "Cloudflare's Pages landing page tells new projects to start with Workers. A Pages blueprint would ship a shape Cloudflare tells greenfield projects not to start. The maintenance load of a second deploy blueprint (its own ADRs, its own vendor URL trace, its own promote workflow) buys a shape Cloudflare itself recommends against; the round-6 spec (ruling 1) rejects the sibling and folds Workers-with-static-assets into this blueprint's minor bump instead."
+    },
+    {
+      "name": "Leave the shape choice implicit as the v1.1.0 blueprint does",
+      "summary": "Keep the wrangler-shape asset sample as an example only; do not mint an ADR blessing Workers-with-static-assets and do not elicit the assets-directory or run-worker-first parameters.",
+      "reasonNotChosen": "The v1.1.0 sample teaches the shape but does not commit to it; a project applying the blueprint has to reach for the sample and decide alone. Naming the ratified default as an ADR with a standards trace makes the shape decision legible in the applied project, and eliciting the two knobs surfaces the ratified shape's parameters where the operator can see them at apply."
+    },
+    {
+      "name": "Bless Workers-with-static-assets only through the guide, without an ADR contribution",
+      "summary": "Add the guide section but do not mint an ADR; keep the shape as prose guidance rather than an architected decision.",
+      "reasonNotChosen": "The standards-derived-discipline discipline (blueprint-authoring.md section 8a) requires an ADR with standardsTraceClause for any decision that traces to a vendor standard. Blessing the shape only in the guide leaves no traceable decision record and no place for a superseding project-level ADR to hang off. The blueprint's own trace mechanism is exactly this shape."
+    }
+  ],
+  "createdAt": "2026-09-07T00:00:00Z",
+  "updatedAt": "2026-09-07T00:00:00Z"
+}