rcf-lite 0.22.0 → 0.24.0

package/blueprints/platform-cloudflare-durable-objects/contributions/probes/websocket-hub-broadcast.mjs

@@ -0,0 +1,112 @@
+// Websocket-hub-broadcast probe for platform-cloudflare-durable-objects v1.0.0.
+//
+// Wires a HubObject to a fake state, accepts two fake sockets
+// (createFakeSocketPair), drives a broadcast from client A and
+// asserts B receives within the elicited window (default 500ms).
+// Then drives hibernate-and-wake round-trip: hibernate, wake once
+// (doWakeUp emitted, lastBroadcast returned), wake again (no
+// second doWakeUp). Finally scans every emitted record on the sink
+// against the allowed key set {event, key, size, ttl, timestamp,
+// objectName, scheduledTime} and asserts zero forbidden-key hits
+// (AC-33106-1); under SIMULATE_PII_LEAK=true a wrapped sink forwards
+// a synthetic body-bearing record and the probe surfaces it,
+// returning fail on the secrecy result.
+//
+// Under SIMULATE_HUB_HANG=true the broadcast handler is wrapped
+// with an artificial delay past the elicited window; the probe
+// surfaces the hang and returns fail on the broadcast-within-
+// window check.
+//
+// anchorAcId: AC-33105-1 (primary; AC-33110-1 and AC-33106-1
+// covered as additional results).
+// accountBound: false.
+
+export const anchorAcId = 'AC-33105-1';
+export const accountBound = false;
+
+const ALLOWED_KEYS = new Set(['event', 'key', 'size', 'ttl', 'timestamp', 'objectName', 'scheduledTime']);
+const FORBIDDEN_KEYS = ['body', 'ssn', 'userId', 'headers', 'cookies', 'request', 'payload'];
+
+export default async function runProbe() {
+  const { createInMemoryDoStorage } = await import('../../../../packages/rcf-lite/test/fixtures/cf-platform/src/do-storage.mjs');
+  const { HubObject } = await import('../../../../packages/rcf-lite/test/fixtures/cf-platform/src/do-hub.mjs');
+  const { createFakeState, createFakeSocketPair } = await import('./probe-utils.mjs');
+
+  const events = [];
+  const cleanSink = (rec) => events.push(rec);
+  const leakySink = (rec) => events.push({
+    ...rec,
+    body: 'Hello, world (leaked test body)',
+    ssn: '123-45-6789',
+    userId: 'user_leaked_test_uid',
+  });
+  const eventSink = process.env.SIMULATE_PII_LEAK === 'true' ? leakySink : cleanSink;
+  const storage = createInMemoryDoStorage({ backend: 'sql' });
+  const state = createFakeState();
+  const hub = new HubObject({ state, storage, eventSink, name: 'lobby', hibernateAfterIdleMs: 500 });
+
+  const sockA = createFakeSocketPair('A');
+  const sockB = createFakeSocketPair('B');
+  await hub.accept(sockA);
+  await hub.accept(sockB);
+
+  const results = [];
+
+  // AC-33105-1: broadcast from A reaches both A and B within 500ms.
+  const started = Date.now();
+  const payload = 'ping';
+  if (process.env.SIMULATE_HUB_HANG === 'true') {
+    await new Promise((r) => setTimeout(r, 750));
+  }
+  await hub.webSocketMessage(sockA, JSON.stringify({ type: 'broadcast', payload }));
+  const elapsed = Date.now() - started;
+  const gotA = sockA.inbound.find((s) => s.includes('"payload":"ping"'));
+  const gotB = sockB.inbound.find((s) => s.includes('"payload":"ping"'));
+  const persisted = await storage.get('lastBroadcast');
+  const broadcastOk = !!gotA && !!gotB && elapsed <= 500 && !!persisted && persisted.includes('"payload":"ping"');
+  results.push({
+    anchorAcId: 'AC-33105-1',
+    verdict: broadcastOk ? 'pass' : 'fail',
+    detail: broadcastOk
+      ? `broadcast fan-out: A received ${gotA} B received ${gotB}; elapsed ${elapsed}ms within 500ms window; storage.lastBroadcast persisted`
+      : `broadcast fault: gotA=${!!gotA} gotB=${!!gotB} elapsed=${elapsed}ms persisted=${!!persisted}`,
+  });
+
+  // AC-33110-1: hibernate-and-wake round-trip preserves storage and doWakeUp fires exactly once.
+  const preWakeCount = events.length;
+  await hub.hibernate();
+  const wake1 = await hub.wake();
+  const wake2 = await hub.wake();
+  const wakeEvents = events.slice(preWakeCount).filter((e) => e.event === 'doWakeUp');
+  const hibernateOk =
+    wake1.lastBroadcast === persisted &&
+    wake2.alreadyAwake === true &&
+    wake2.lastBroadcast === persisted &&
+    wakeEvents.length === 1;
+  results.push({
+    anchorAcId: 'AC-33110-1',
+    verdict: hibernateOk ? 'pass' : 'fail',
+    detail: hibernateOk
+      ? `hibernate-and-wake round-trip: doWakeUp fired once; wake1.lastBroadcast preserved; wake2.alreadyAwake=true with same lastBroadcast`
+      : `hibernate-wake fault: wakeEventCount=${wakeEvents.length} wake1=${JSON.stringify(wake1)} wake2=${JSON.stringify(wake2)}`,
+  });
+
+  // AC-33106-1: every event carries only allowed keys; no forbidden keys.
+  const forbiddenHits = [];
+  const extraKeyHits = [];
+  for (const rec of events) {
+    const extras = Object.keys(rec).filter((k) => !ALLOWED_KEYS.has(k));
+    if (extras.length) extraKeyHits.push({ event: rec.event, extras });
+    for (const k of FORBIDDEN_KEYS) if (k in rec) forbiddenHits.push({ event: rec.event, forbiddenKey: k });
+  }
+  const secrecyOk = forbiddenHits.length === 0 && extraKeyHits.length === 0;
+  results.push({
+    anchorAcId: 'AC-33106-1',
+    verdict: secrecyOk ? 'pass' : 'fail',
+    detail: secrecyOk
+      ? `event-secrecy scan across ${events.length} records: allowed-key set {${[...ALLOWED_KEYS].join(', ')}}; forbidden-key hits 0; extra-key hits 0`
+      : `event-secrecy fault: forbiddenHits=${JSON.stringify(forbiddenHits.slice(0, 5))} extraKeyHits=${JSON.stringify(extraKeyHits.slice(0, 5))}`,
+  });
+
+  return { results };
+}

package/blueprints/platform-cloudflare-durable-objects/contributions/probes/wrangler-seam.mjs

@@ -0,0 +1,257 @@
+// Wrangler-seam probe for platform-cloudflare-durable-objects v1.0.0.
+//
+// Spawns `wrangler dev --local` on the cf-platform fixture and
+// exercises the two shipped DO shapes through workerd:
+//
+//  (a) two concurrent `POST /cell/<id>/increment` requests routed
+//      through `src/index.mjs` -> `createDoFacade({env}).cellFetch`
+//      -> `env.CELL.idFromName(id).fetch(...)` -> the shipped
+//      SingleCellObject class. Asserts the two responses observe
+//      per-instance serialisation: counters equal [1, 2] in some
+//      order, witnesses equal [0, 1] in some order (each request
+//      observed the prior write). Under the shipped code path the
+//      SingleCellObject `_serialise` promise queue plus workerd's
+//      per-instance dispatch both provide the guarantee; removing
+//      the queue surfaces two responses of {counter:1, witness:0}
+//      on the mutation-run.
+//  (b) one WebSocket upgrade against `/hub/<id>/connect` reaching
+//      `env.HUB`; asserts a single broadcast frame arrives on
+//      connect (the shipped HubObject fetch handler accepts the
+//      server half via `state.acceptWebSocket` and sends one
+//      broadcast frame immediately, so the probe does not need a
+//      second client to trigger fan-out).
+//
+// The probe also carries an additional AC-33108-1 result that
+// greps the fixture wrangler.toml for the two `[[durable_objects.bindings]]`
+// binding pairs (name/class_name) and the `[[migrations]]` block
+// (tag `"v1"` plus new_classes for both classes). That result is
+// deterministic and does not require wrangler.
+//
+// Warn semantics per section 3.1 pass-with-skip: if the wrangler
+// devDependency is missing under `packages/rcf-lite/test/fixtures/cf-platform/node_modules/.bin`,
+// or if the CLI does not bind within the cap, the probe returns
+// aggregateVerdict warn (never fail); the wrangler.toml grep result
+// still runs and reports pass. A handler thrown at the workerd
+// boundary is a genuine `fail` per the gate reviewer's directive.
+//
+// anchorAcId: AC-33113-1 (wrangler-seam runtime coverage);
+// AC-33108-1 covered as an additional result.
+// accountBound: false.
+
+import { spawn } from 'node:child_process';
+import { readFile } from 'node:fs/promises';
+import { existsSync } from 'node:fs';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+export const anchorAcId = 'AC-33113-1';
+export const accountBound = false;
+
+const BIND_CAP_MS = 45000;
+const KILL_GRACE_MS = 2000;
+const WS_CAP_MS = 5000;
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const FIXTURE_DIR = resolve(HERE, '..', '..', '..', '..', 'packages', 'rcf-lite', 'test', 'fixtures', 'cf-platform');
+
+function findWranglerBin() {
+  const candidate = resolve(FIXTURE_DIR, 'node_modules', '.bin', 'wrangler');
+  return existsSync(candidate) ? candidate : null;
+}
+
+async function killAndDrain(proc) {
+  if (!proc || proc.killed) return;
+  try { proc.kill('SIGTERM'); } catch (_err) { /* best effort */ }
+  await new Promise((r) => setTimeout(r, KILL_GRACE_MS));
+  try { if (!proc.killed) proc.kill('SIGKILL'); } catch (_err) { /* best effort */ }
+}
+
+async function greppedWranglerToml() {
+  const toml = await readFile(resolve(FIXTURE_DIR, 'wrangler.toml'), 'utf8');
+  const cellNameHit = /name = "CELL"/.test(toml);
+  const cellClassHit = /class_name = "SingleCellObject"/.test(toml);
+  const hubNameHit = /name = "HUB"/.test(toml);
+  const hubClassHit = /class_name = "HubObject"/.test(toml);
+  const tagHit = /tag = "v1"/.test(toml);
+  const newClassesHit = /new_classes = \["SingleCellObject", "HubObject"\]/.test(toml);
+  return {
+    ok: cellNameHit && cellClassHit && hubNameHit && hubClassHit && tagHit && newClassesHit,
+    hits: { cellNameHit, cellClassHit, hubNameHit, hubClassHit, tagHit, newClassesHit },
+  };
+}
+
+async function driveConcurrentIncrements(boundUrl) {
+  const target = `${boundUrl}/cell/wrangler-seam-cell-${Date.now()}/increment`;
+  const [a, b] = await Promise.all([
+    fetch(target, { method: 'POST' }),
+    fetch(target, { method: 'POST' }),
+  ]);
+  if (!a.ok || !b.ok) {
+    return { ok: false, reason: `HTTP status a=${a.status} b=${b.status}`, target };
+  }
+  const [ja, jb] = await Promise.all([a.json(), b.json()]);
+  const counters = [ja.counter, jb.counter].sort((x, y) => x - y);
+  const witnesses = [ja.witness, jb.witness].sort((x, y) => x - y);
+  const serialised =
+    counters[0] === 1 && counters[1] === 2 &&
+    witnesses[0] === 0 && witnesses[1] === 1;
+  return {
+    ok: serialised,
+    counters,
+    witnesses,
+    responses: [ja, jb],
+    target,
+  };
+}
+
+async function drainOneWebSocketFrame(boundUrl) {
+  const wsUrl = boundUrl.replace(/^http/, 'ws') + `/hub/wrangler-seam-hub-${Date.now()}/connect`;
+  return new Promise((resolveResult) => {
+    let settled = false;
+    const timer = setTimeout(() => {
+      if (settled) return;
+      settled = true;
+      try { ws.close(); } catch (_err) { /* best effort */ }
+      resolveResult({ ok: false, reason: `no frame received within ${WS_CAP_MS}ms`, wsUrl });
+    }, WS_CAP_MS);
+    let ws;
+    try {
+      ws = new WebSocket(wsUrl);
+    } catch (err) {
+      clearTimeout(timer);
+      settled = true;
+      return resolveResult({ ok: false, reason: `WebSocket construct threw: ${err && err.message ? err.message : String(err)}`, wsUrl });
+    }
+    ws.addEventListener('message', (ev) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      const payload = typeof ev.data === 'string' ? ev.data : String(ev.data);
+      try { ws.close(); } catch (_err) { /* best effort */ }
+      resolveResult({ ok: payload.includes('"payload":"hello-from-hub"'), payload, wsUrl });
+    });
+    ws.addEventListener('error', (err) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      resolveResult({ ok: false, reason: `WebSocket error: ${err && err.message ? err.message : 'no message'}`, wsUrl });
+    });
+    ws.addEventListener('close', (ev) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      resolveResult({ ok: false, reason: `WebSocket closed before message: code=${ev.code} reason=${ev.reason}`, wsUrl });
+    });
+  });
+}
+
+export default async function runProbe() {
+  const results = [];
+
+  // AC-33108-1 (additional result): wrangler.toml literal-strings
+  // grep. Deterministic; runs first so a wrangler-missing warn
+  // does not hide it.
+  const toml = await greppedWranglerToml();
+  results.push({
+    anchorAcId: 'AC-33108-1',
+    verdict: toml.ok ? 'pass' : 'fail',
+    detail: toml.ok
+      ? `wrangler.toml carries name="CELL" + class_name="SingleCellObject", name="HUB" + class_name="HubObject", and [[migrations]] tag "v1" with new_classes ["SingleCellObject","HubObject"]`
+      : `wrangler.toml grep miss: ${JSON.stringify(toml.hits)}`,
+  });
+
+  const bin = findWranglerBin();
+  if (!bin) {
+    results.push({
+      anchorAcId: 'AC-33113-1',
+      verdict: 'warn',
+      detail: `wrangler devDependency not installed under ${FIXTURE_DIR}/node_modules/.bin/wrangler; run pnpm install --ignore-workspace in the fixture directory to bring the CLI onto the tree. Mechanism-reach gap noted; the in-process probes carry the runtime evidence for the shipped DO classes.`,
+    });
+    return { results, extra: { wranglerBinPresent: false } };
+  }
+
+  const proc = spawn(bin, ['dev', '--local', '--port', '0'], {
+    cwd: FIXTURE_DIR,
+    env: process.env,
+    stdio: ['ignore', 'pipe', 'pipe'],
+  });
+
+  let boundUrl = null;
+  let stderrTail = '';
+  let stdoutTail = '';
+  proc.stdout.on('data', (buf) => {
+    const s = buf.toString();
+    stdoutTail = (stdoutTail + s).slice(-2000);
+    const match = s.match(/http:\/\/(?:127\.0\.0\.1|localhost):(\d+)/i);
+    if (match && !boundUrl) boundUrl = `http://127.0.0.1:${match[1]}`;
+  });
+  proc.stderr.on('data', (buf) => {
+    stderrTail = (stderrTail + buf.toString()).slice(-2000);
+  });
+
+  const bindStart = Date.now();
+  while (!boundUrl && Date.now() - bindStart < BIND_CAP_MS) {
+    if (proc.exitCode !== null) break;
+    await new Promise((r) => setTimeout(r, 250));
+  }
+
+  if (!boundUrl) {
+    await killAndDrain(proc);
+    results.push({
+      anchorAcId: 'AC-33113-1',
+      verdict: 'warn',
+      detail: `wrangler dev did not bind within ${BIND_CAP_MS}ms cap; treated as a CLI regression per spec section 3.1 pass-with-skip. stderr tail: ${stderrTail.slice(-500)} stdout tail: ${stdoutTail.slice(-500)}`,
+    });
+    return { results, extra: { boundUrl: null, wranglerBinPresent: true } };
+  }
+
+  // Small settle delay so DO namespaces are wired before requests fire.
+  await new Promise((r) => setTimeout(r, 500));
+
+  let seamResult = null;
+  let handlerThrew = false;
+  try {
+    seamResult = await driveConcurrentIncrements(boundUrl);
+  } catch (err) {
+    handlerThrew = true;
+    seamResult = { ok: false, reason: `probe threw at increment: ${err && err.message ? err.message : String(err)}` };
+  }
+
+  let wsResult = null;
+  try {
+    wsResult = await drainOneWebSocketFrame(boundUrl);
+  } catch (err) {
+    handlerThrew = true;
+    wsResult = { ok: false, reason: `probe threw at ws: ${err && err.message ? err.message : String(err)}` };
+  }
+
+  await killAndDrain(proc);
+
+  // Serialisation result: fail if the handler surfaced a thrown
+  // error at the workerd boundary; else pass/fail based on the
+  // observed serialisation shape.
+  if (handlerThrew) {
+    results.push({
+      anchorAcId: 'AC-33113-1',
+      verdict: 'fail',
+      detail: `handler threw at the workerd boundary during the wrangler-seam drive; increment=${seamResult?.reason ?? 'n/a'}; websocket=${wsResult?.reason ?? 'n/a'}`,
+    });
+  } else {
+    results.push({
+      anchorAcId: 'AC-33113-1',
+      verdict: seamResult.ok ? 'pass' : 'fail',
+      detail: seamResult.ok
+        ? `two concurrent POST ${seamResult.target} responded with counters=${JSON.stringify(seamResult.counters)} witnesses=${JSON.stringify(seamResult.witnesses)}; serialisation observed under workerd (each request read the other's write)`
+        : `serialisation fault under workerd: ${seamResult.reason ?? `counters=${JSON.stringify(seamResult.counters)} witnesses=${JSON.stringify(seamResult.witnesses)} responses=${JSON.stringify(seamResult.responses ?? null)}`}`,
+    });
+    results.push({
+      anchorAcId: 'AC-33105-1',
+      verdict: wsResult.ok ? 'pass' : 'fail',
+      detail: wsResult.ok
+        ? `WebSocket upgrade against ${wsResult.wsUrl} received one broadcast frame with payload=${wsResult.payload}`
+        : `websocket fault: ${wsResult.reason} (url=${wsResult.wsUrl})`,
+    });
+  }
+
+  return { results, extra: { boundUrl, wranglerBinPresent: true } };
+}

package/blueprints/platform-cloudflare-durable-objects/contributions/requirements/platform-cloudflare-durable-objects-req-001.json

@@ -0,0 +1,17 @@
+{
+  "reqId": "platform-cloudflare-durable-objects-REQ-001",
+  "prdId": "PRD-001",
+  "title": "The DO namespace facade is the sole reader of env.CELL and env.HUB and opens on boot with namespaceReady",
+  "description": "The applying project reaches Cloudflare Durable Objects through a single facade module in the project source tree that is the ONLY module holding a reference to the DO namespace bindings (env.CELL for the single-cell shape and env.HUB for the hibernatable-WebSocket hub shape per https://developers.cloudflare.com/durable-objects/). On process boot the facade wires the injected event sink and emits a namespaceReady lifecycle event with a metadata-only payload. Every consumer of DO from the applied project code calls the facade's typed handles; no other module dereferences env.CELL or env.HUB.",
+  "category": "functional",
+  "domain": "platform",
+  "priority": "must",
+  "rationale": "Ratified in the Cloudflare round 6 spec (2026-09-06 section 5.3). Ships as v1.0.0 of platform-cloudflare-durable-objects.",
+  "tags": [
+    "blueprint:platform-cloudflare-durable-objects"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-07T14:00:00.000Z",
+  "updatedAt": "2026-09-07T14:00:00.000Z"
+}

package/blueprints/platform-cloudflare-durable-objects/contributions/requirements/platform-cloudflare-durable-objects-req-002.json

@@ -0,0 +1,17 @@
+{
+  "reqId": "platform-cloudflare-durable-objects-REQ-002",
+  "prdId": "PRD-001",
+  "title": "The single-cell shape exposes typed domain verbs and serialises concurrent invocations per instance",
+  "description": "A named single-cell object exposes typed domain verbs (increment, read, reset). Cloudflare's documented Durable Objects consistency model serialises invocations against the same instance per https://developers.cloudflare.com/durable-objects/; the shipped SingleCellObject class realises that contract so a concurrent-increment probe observes the counter sum and one increment observed the other via a written witness.",
+  "category": "functional",
+  "domain": "platform",
+  "priority": "must",
+  "rationale": "Ratified in the Cloudflare round 6 spec (2026-09-06 section 5.3). Ships as v1.0.0 of platform-cloudflare-durable-objects.",
+  "tags": [
+    "blueprint:platform-cloudflare-durable-objects"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-07T14:00:00.000Z",
+  "updatedAt": "2026-09-07T14:00:00.000Z"
+}

package/blueprints/platform-cloudflare-durable-objects/contributions/requirements/platform-cloudflare-durable-objects-req-003.json

@@ -0,0 +1,17 @@
+{
+  "reqId": "platform-cloudflare-durable-objects-REQ-003",
+  "prdId": "PRD-001",
+  "title": "The storage API provides typed put/get/delete on the object with an elicited backend (SQL or KV)",
+  "description": "The object's state.storage surface exposes typed put(key, value), get(key), delete(key) and list({prefix}) verbs per https://developers.cloudflare.com/durable-objects/. Storage backend is elicited (sql or kv per ADR-3403); the shipped class code is backend-agnostic and threads through the elicited answer. A storage round-trip probe drives both backends via a fixture switch.",
+  "category": "functional",
+  "domain": "platform",
+  "priority": "must",
+  "rationale": "Ratified in the Cloudflare round 6 spec (2026-09-06 section 5.3). Ships as v1.0.0 of platform-cloudflare-durable-objects.",
+  "tags": [
+    "blueprint:platform-cloudflare-durable-objects"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-07T14:00:00.000Z",
+  "updatedAt": "2026-09-07T14:00:00.000Z"
+}

package/blueprints/platform-cloudflare-durable-objects/contributions/requirements/platform-cloudflare-durable-objects-req-004.json

@@ -0,0 +1,17 @@
+{
+  "reqId": "platform-cloudflare-durable-objects-REQ-004",
+  "prdId": "PRD-001",
+  "title": "The alarm surface fires alarm() exactly once per scheduled time and doAlarmFired carries object name and scheduled time",
+  "description": "A named object supports storage.setAlarm(scheduledTime) and an alarm() handler per https://developers.cloudflare.com/durable-objects/. Cloudflare's runtime guarantees alarm delivery once per scheduled time; the shipped class realises the handler and the injected event sink records a doAlarmFired event with {objectName, scheduledTime} metadata fields alongside the metadata-only lifecycle payload.",
+  "category": "functional",
+  "domain": "platform",
+  "priority": "must",
+  "rationale": "Ratified in the Cloudflare round 6 spec (2026-09-06 section 5.3). Ships as v1.0.0 of platform-cloudflare-durable-objects.",
+  "tags": [
+    "blueprint:platform-cloudflare-durable-objects"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-07T14:00:00.000Z",
+  "updatedAt": "2026-09-07T14:00:00.000Z"
+}

package/blueprints/platform-cloudflare-durable-objects/contributions/requirements/platform-cloudflare-durable-objects-req-005.json

@@ -0,0 +1,17 @@
+{
+  "reqId": "platform-cloudflare-durable-objects-REQ-005",
+  "prdId": "PRD-001",
+  "title": "The hibernatable WebSocket hub accepts clients via state.acceptWebSocket and the wake handler runs from cold reading the same storage",
+  "description": "A named hub object accepts websocket clients via state.acceptWebSocket per Cloudflare's hibernatable WebSockets shape (https://developers.cloudflare.com/durable-objects/), routes each message to per-message handlers by JSON type field, and broadcasts to all connected sockets. On hibernate-and-wake the wake handler runs from a cold start and reads the same storage; the shipped hub class re-emits doWakeUp on the injected event sink on the first message after hibernation.",
+  "category": "functional",
+  "domain": "platform",
+  "priority": "must",
+  "rationale": "Ratified in the Cloudflare round 6 spec (2026-09-06 section 5.3). Ships as v1.0.0 of platform-cloudflare-durable-objects.",
+  "tags": [
+    "blueprint:platform-cloudflare-durable-objects"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-07T14:00:00.000Z",
+  "updatedAt": "2026-09-07T14:00:00.000Z"
+}

package/blueprints/platform-cloudflare-durable-objects/contributions/requirements/platform-cloudflare-durable-objects-req-006.json

@@ -0,0 +1,17 @@
+{
+  "reqId": "platform-cloudflare-durable-objects-REQ-006",
+  "prdId": "PRD-001",
+  "title": "Lifecycle events fire at namespace and object level with metadata-only payloads",
+  "description": "The facade and the objects emit lifecycle events on the injected event sink: namespaceReady (facade), doAccept, doAlarmFired, doWakeUp, doHibernate (object). Every payload is metadata-only ({event, key, size, ttl, timestamp, ?objectName, ?scheduledTime}); no message payloads, no request bodies, no PII cross the sink boundary. A logging companion renders records directly without a per-blueprint scrub pass.",
+  "category": "functional",
+  "domain": "platform",
+  "priority": "must",
+  "rationale": "Ratified in the Cloudflare round 6 spec (2026-09-06 section 5.3). Ships as v1.0.0 of platform-cloudflare-durable-objects.",
+  "tags": [
+    "blueprint:platform-cloudflare-durable-objects"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-07T14:00:00.000Z",
+  "updatedAt": "2026-09-07T14:00:00.000Z"
+}

package/blueprints/platform-cloudflare-durable-objects/contributions/requirements/platform-cloudflare-durable-objects-req-007.json

@@ -0,0 +1,17 @@
+{
+  "reqId": "platform-cloudflare-durable-objects-REQ-007",
+  "prdId": "PRD-001",
+  "title": "The sole-reader guarantee is enforced by an AST scan: no non-facade module imports env.CELL or env.HUB",
+  "description": "The shipped sole-reader-scan probe parses every .ts/.js/.mjs file under the fixture's applied source root, matches \"env.CELL\" and \"env.HUB\" identifier accesses against the facade module boundary, and reports every non-facade site as a leak. A project that carries a legacy call site converts it to a facade call or the probe returns aggregateVerdict: fail.",
+  "category": "functional",
+  "domain": "platform",
+  "priority": "must",
+  "rationale": "Ratified in the Cloudflare round 6 spec (2026-09-06 section 5.3). Ships as v1.0.0 of platform-cloudflare-durable-objects.",
+  "tags": [
+    "blueprint:platform-cloudflare-durable-objects"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-07T14:00:00.000Z",
+  "updatedAt": "2026-09-07T14:00:00.000Z"
+}

package/blueprints/platform-cloudflare-durable-objects/contributions/requirements/platform-cloudflare-durable-objects-req-008.json

@@ -0,0 +1,17 @@
+{
+  "reqId": "platform-cloudflare-durable-objects-REQ-008",
+  "prdId": "PRD-001",
+  "title": "Migration-safe class exports: the DO class name is a stable string committed to wrangler config with a matching migrations table",
+  "description": "The DO class names (SingleCellObject, HubObject) are stable strings committed on the [[durable_objects.bindings]] blocks in wrangler.toml, and a paired [[migrations]] block records the class names under the mint tag (v1) per Cloudflare's migration documentation (https://developers.cloudflare.com/durable-objects/). A rename lands as a subsequent migration tag on the same list; a rename without a migration is a runtime error the shipped anatomy test catches at self-review.",
+  "category": "functional",
+  "domain": "platform",
+  "priority": "must",
+  "rationale": "Ratified in the Cloudflare round 6 spec (2026-09-06 section 5.3). Ships as v1.0.0 of platform-cloudflare-durable-objects.",
+  "tags": [
+    "blueprint:platform-cloudflare-durable-objects"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-07T14:00:00.000Z",
+  "updatedAt": "2026-09-07T14:00:00.000Z"
+}

package/blueprints/platform-cloudflare-durable-objects/contributions/tacs/tac-3401-platform-cloudflare-durable-objects-namespace-facade.json

@@ -0,0 +1,31 @@
+{
+  "tacId": "TAC-3401-platform-cloudflare-durable-objects-namespace-facade",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "name": "Platform-cloudflare-durable-objects namespace facade",
+  "purpose": "The single project-side module realising the DO namespace facade shape. It is the sole reader of env.CELL and env.HUB, wires the injected event sink at boot, emits namespaceReady on the first successful ready-check and exports typed handles (cellHandle(name), hubHandle(name)) plus an in-process variant (createDoFacadeInProcess) for probe drives. Consumers never touch env.CELL or env.HUB outside this module; the facade is the one place the vendor surface lives so a future DO adapter (a different platform, an in-process fake) slots in without a consumer re-shape.",
+  "responsibilities": [
+    "Export createDoFacade({env, eventSink, clock}) returning {ready, cellHandle, hubHandle} matching the Cloudflare Workers DO namespace-binding shape (AC-33101-1, AC-33107-1).",
+    "Own the ONLY references to env.CELL and env.HUB in the applied source tree (AC-33107-1).",
+    "Emit namespaceReady on the injected sink at ready-check with a metadata-only payload (AC-33101-1).",
+    "Export createDoFacadeInProcess({singleCell, hub, eventSink, clock}) that returns typed handles wired to already-constructed in-process instances so the probes exercise the shipped facade code path without a wrangler dev process."
+  ],
+  "internalStructure": "Two named factories in one module: createDoFacade wraps the Cloudflare env bindings; createDoFacadeInProcess wraps in-process class instances. Both share the same ready() lifecycle-event contract.",
+  "interfaces": [
+    {
+      "name": "createDoFacade",
+      "kind": "factory",
+      "summary": "DO namespace facade factory over env.CELL and env.HUB."
+    },
+    {
+      "name": "createDoFacadeInProcess",
+      "kind": "factory",
+      "summary": "In-process DO facade factory over already-constructed class instances (probe variant)."
+    }
+  ],
+  "dependencies": [],
+  "createdAt": "2026-09-07T14:00:00.000Z",
+  "updatedAt": "2026-09-07T14:00:00.000Z"
+}

package/blueprints/platform-cloudflare-durable-objects/contributions/tacs/tac-3402-platform-cloudflare-durable-objects-single-cell-shape.json

@@ -0,0 +1,30 @@
+{
+  "tacId": "TAC-3402-platform-cloudflare-durable-objects-single-cell-shape",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "name": "Platform-cloudflare-durable-objects single-cell shape",
+  "purpose": "The named-object class realising the single-cell authoritative-state shape per Cloudflare's Durable Objects consistency model. Concurrent invocations against the same instance serialise via a per-instance promise queue (matching the DO runtime contract). The class exposes typed domain verbs (increment, read, reset) that wrap the injected storage driver.",
+  "responsibilities": [
+    "Serialise concurrent invocations against the same instance in FIFO order (AC-33102-1, AC-33109-1).",
+    "Round-trip storage on both SQL and KV backends via the injected driver factory (AC-33103-1, AC-33111-1).",
+    "Own storage.setAlarm and the alarm() handler with a metadata-only doAlarmFired event on the sink (AC-33104-1)."
+  ],
+  "internalStructure": "One class SingleCellObject with constructor({storage, eventSink, name, clock}), a private serialised queue, and methods increment/read/reset/setAlarm/alarm.",
+  "interfaces": [
+    {
+      "name": "SingleCellObject",
+      "kind": "class",
+      "summary": "Single-cell DO class realising strongly consistent authoritative-state shape."
+    },
+    {
+      "name": "createSingleCell",
+      "kind": "factory",
+      "summary": "Test-friendly factory that returns a new SingleCellObject."
+    }
+  ],
+  "dependencies": [],
+  "createdAt": "2026-09-07T14:00:00.000Z",
+  "updatedAt": "2026-09-07T14:00:00.000Z"
+}

package/blueprints/platform-cloudflare-durable-objects/contributions/tacs/tac-3403-platform-cloudflare-durable-objects-alarm-handler.json

@@ -0,0 +1,29 @@
+{
+  "tacId": "TAC-3403-platform-cloudflare-durable-objects-alarm-handler",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "name": "Platform-cloudflare-durable-objects alarm handler",
+  "purpose": "The alarm surface on the single-cell class realising storage.setAlarm and alarm(). Cloudflare's runtime guarantees exactly-once alarm delivery per scheduled time; the shipped alarm() handler drains the persisted alarm from storage and emits doAlarmFired on the sink with metadata-only {objectName, scheduledTime}.",
+  "responsibilities": [
+    "Persist and drain the scheduled alarm via storage.setAlarm/getAlarm/deleteAlarm (AC-33104-1).",
+    "Emit doAlarmFired with {objectName, scheduledTime} on the sink at every fire (AC-33104-1, AC-33106-1)."
+  ],
+  "internalStructure": "A pair of instance methods (setAlarm(offsetMs), alarm()) on the SingleCellObject class. The alarm handler is idempotent per scheduled time via storage-drain semantics.",
+  "interfaces": [
+    {
+      "name": "SingleCellObject.setAlarm",
+      "kind": "method",
+      "summary": "Schedule an alarm for now+offsetMs; persists via storage.setAlarm."
+    },
+    {
+      "name": "SingleCellObject.alarm",
+      "kind": "method",
+      "summary": "Alarm handler; drains the persisted alarm and emits doAlarmFired."
+    }
+  ],
+  "dependencies": [],
+  "createdAt": "2026-09-07T14:00:00.000Z",
+  "updatedAt": "2026-09-07T14:00:00.000Z"
+}

package/blueprints/platform-cloudflare-durable-objects/contributions/tacs/tac-3404-platform-cloudflare-durable-objects-websocket-hub.json

@@ -0,0 +1,31 @@
+{
+  "tacId": "TAC-3404-platform-cloudflare-durable-objects-websocket-hub",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "name": "Platform-cloudflare-durable-objects websocket hub",
+  "purpose": "The hub-shape class realising Cloudflare's hibernatable WebSockets shape. A HubObject accepts websocket clients via state.acceptWebSocket, routes each incoming message by JSON type field (broadcast, set-state, get-state) and fans out broadcasts to all connected sockets. On hibernate-and-wake, the wake handler runs from cold and reads the same storage; doWakeUp is idempotent-by-contract per ADR-3405.",
+  "responsibilities": [
+    "Accept websocket clients via state.acceptWebSocket and emit doAccept on the sink (AC-33105-1).",
+    "Route each webSocketMessage by JSON type field to broadcast, set-state, get-state handlers (AC-33105-1).",
+    "Persist lastBroadcast to storage on every broadcast so hibernate-and-wake preserves it (AC-33110-1).",
+    "Emit doHibernate on hibernate; emit doWakeUp exactly once on the first wake (AC-33110-1, AC-33106-1)."
+  ],
+  "internalStructure": "One class HubObject with constructor({state, storage, eventSink, name, hibernateAfterIdleMs, clock}), a websocket dispatch method (webSocketMessage), a close handler (webSocketClose), and idempotent hibernate/wake methods.",
+  "interfaces": [
+    {
+      "name": "HubObject",
+      "kind": "class",
+      "summary": "Hub DO class realising hibernatable WebSocket coordination shape."
+    },
+    {
+      "name": "createHub",
+      "kind": "factory",
+      "summary": "Test-friendly factory that returns a new HubObject."
+    }
+  ],
+  "dependencies": [],
+  "createdAt": "2026-09-07T14:00:00.000Z",
+  "updatedAt": "2026-09-07T14:00:00.000Z"
+}