rcf-lite 0.22.0 → 0.24.0

package/rcf/adrs/adr-3501-edge-cloudflare-access-jwt-gate.json

@@ -0,0 +1,13 @@
+{
+  "createdAt": "2026-09-07T16:53:44.665Z",
+  "updatedAt": "2026-09-07T17:03:08.688Z",
+  "adrId": "ADR-3501-edge-cloudflare-access-jwt-gate",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "accepted",
+  "title": "Edge authentication gate: Cloudflare Access Zero-Trust JWT-assertion gate (scope global, new topic edgeAuthenticationGate)",
+  "context": "T-4 repo-chain ADR mirror for the shipped blueprints/edge-cloudflare-access/contributions/adrs/adr-3501-edge-cloudflare-access-jwt-gate.json contribution. The chain slice is the audit trail for the JWT-gate decision (scope global on new topic edgeAuthenticationGate). Cloudflare Access enforces the Zero-Trust policy at the CF edge and passes a signed JWT to the origin Worker in the Cf-Access-Jwt-Assertion header per https://developers.cloudflare.com/cloudflare-one/policies/access/. Every applied Worker needs one project-wide answer to the edgeAuthenticationGate topic; a future non-Cloudflare adapter conflicts on the same topic by design.",
+  "decision": "The shipped v1.0.0 default is Cloudflare Access's Zero-Trust JWT-assertion gate. The JWT validator (TAC-3501) is the sole reader of the Cf-Access-Jwt-Assertion header and reduces the principal into request.auth. The edgeAuthenticationGate topic scope is global on this blueprint; the topic string is edgeAuthenticationGate (lower camel case). Standards trace clause: Cloudflare Access policy actions and rule selectors.",
+  "consequences": "The applying project inherits Cloudflare's documented Access policy model and the JWT rotation cadence published at https://<team>.cloudflareaccess.com/cdn-cgi/access/certs. Consumers deploying to a non-Cloudflare edge reach for a sibling adapter blueprint that lands as a v1.x minor on this shelf."
+}

package/rcf/adrs/adr-3502-edge-cloudflare-access-identity-provider.json

@@ -0,0 +1,13 @@
+{
+  "createdAt": "2026-09-07T16:53:44.850Z",
+  "updatedAt": "2026-09-07T17:03:08.874Z",
+  "adrId": "ADR-3502-edge-cloudflare-access-identity-provider",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "accepted",
+  "title": "Identity provider for the Access application is elicited (recommendedDefault null)",
+  "context": "Cloudflare Access supports many identity providers (OTP, Google, GitHub, Okta, Entra ID, SAML, OIDC, mTLS); the choice is an enterprise-integration decision.",
+  "decision": "Identity provider is elicited (elicited: true). No recommended default; the applied-sidecar records the operator's answer.",
+  "consequences": "The elicitation forces an explicit operator answer at apply. Standards trace clause: generic enterprise practice."
+}

package/rcf/adrs/adr-3503-edge-cloudflare-access-policy-scope.json

@@ -0,0 +1,13 @@
+{
+  "createdAt": "2026-09-07T16:53:45.034Z",
+  "updatedAt": "2026-09-07T17:03:09.060Z",
+  "adrId": "ADR-3503-edge-cloudflare-access-policy-scope",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "accepted",
+  "title": "Policy scope: application-level (recommended default) or per-path elicited",
+  "context": "Cloudflare Access binds a policy at the application level (one policy protects every path) or per-path. Application-level scope is the most common shape.",
+  "decision": "Recommended default is application-level (recommendedDefault: true); the elicited alternative is per-path. Standards trace clause: Cloudflare Access policy actions and rule selectors.",
+  "consequences": "A fresh project applying the blueprint gets one application-level policy; an operator opting into per-path scope elicits a route table."
+}

package/rcf/adrs/adr-3504-edge-cloudflare-access-audit-retention.json

@@ -0,0 +1,13 @@
+{
+  "createdAt": "2026-09-07T16:53:45.219Z",
+  "updatedAt": "2026-09-07T17:03:09.245Z",
+  "adrId": "ADR-3504-edge-cloudflare-access-audit-retention",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "accepted",
+  "title": "Audit retention window (metadata-only fields) is delegated to the applied logging companion",
+  "context": "The validator emits one audit event per outcome with the metadata-only shape {email, outcome, timestamp, path}. Long-term retention is a compliance decision an applied logging companion already answers.",
+  "decision": "Retention is delegated to the applied logging companion (suggestedCompanions[0]). The blueprint declares no retention policy of its own. Standards trace clause: generic enterprise practice.",
+  "consequences": "A workspace without a logging companion loses the audit events after the Worker context tears down; the guide names the trade."
+}

package/rcf/adrs/adr-3601-edge-cloudflare-turnstile-verifier-contract.json

@@ -0,0 +1,13 @@
+{
+  "createdAt": "2026-09-07T19:56:38.420Z",
+  "updatedAt": "2026-09-07T19:56:38.420Z",
+  "context": "T-5 repo-chain ADR mirror for the shipped blueprints/edge-cloudflare-turnstile/contributions/adrs/adr-3601-edge-cloudflare-turnstile-verifier-contract.json contribution. Cloudflare Turnstile documents a client widget plus a server-side siteverify endpoint (https://challenges.cloudflare.com/turnstile/v0/siteverify) as the wire-shape contract per https://developers.cloudflare.com/turnstile/. Every applied Worker needs one project-wide answer to the humanVerificationGate topic; a future non-Cloudflare adapter (hCaptcha, reCAPTCHA) conflicts on the same topic by design.",
+  "decision": "The shipped v1.0.0 default is Cloudflare Turnstile with server-side siteverify. The verifier POSTs {secret, response} to https://challenges.cloudflare.com/turnstile/v0/siteverify; on success:true the handler proceeds, on success:false the handler rejects 400 with the error-codes value. The humanVerificationGate topic scope is global on this blueprint. Standards trace clause: Cloudflare Turnstile siteverify endpoint documented shape.",
+  "consequences": "The applying project inherits Cloudflare Turnstile documented widget-and-siteverify contract per https://developers.cloudflare.com/turnstile/. A future hCaptcha or reCAPTCHA sibling contributes the same humanVerificationGate topic with a different answer, forcing a deliberate operator-resolved conflict at the project ADR level.",
+  "adrId": "ADR-3601-edge-cloudflare-turnstile-verifier-contract",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "proposed",
+  "title": "Human verification gate: Cloudflare Turnstile siteverify (scope global, new topic humanVerificationGate)"
+}

package/rcf/adrs/adr-3602-edge-cloudflare-turnstile-widget-mode.json

@@ -0,0 +1,13 @@
+{
+  "createdAt": "2026-09-07T19:56:38.606Z",
+  "updatedAt": "2026-09-07T19:56:38.606Z",
+  "context": "Cloudflare Turnstile documents three widget modes per https://developers.cloudflare.com/turnstile/: managed (Cloudflare decides when to show a challenge), non-interactive (always shows a non-interactive challenge) and invisible (mounts an invisible widget). The choice is a per-surface operational profile.",
+  "decision": "Widget mode is elicited (elicited: true). Values: managed, non-interactive, invisible. recommendedDefault: managed. The applied-sidecar records the operator answer per applying surface. Standards trace clause: Cloudflare Turnstile documented widget modes.",
+  "consequences": "The elicitation forces an explicit answer on every apply. The pack fixture accepts mode=managed, non-interactive or invisible and pins the invisible-widget test sitekeys (1x0000000000000000000000BB, 2x0000000000000000000000BB) alongside the managed pass/fail sitekeys so every mode is exercised.",
+  "adrId": "ADR-3602-edge-cloudflare-turnstile-widget-mode",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "proposed",
+  "title": "Widget mode is an elicited enum {managed, non-interactive, invisible}; recommendedDefault managed"
+}

package/rcf/adrs/adr-3603-edge-cloudflare-turnstile-refuse-shape.json

@@ -0,0 +1,13 @@
+{
+  "createdAt": "2026-09-07T19:56:38.789Z",
+  "updatedAt": "2026-09-07T19:56:38.789Z",
+  "context": "Cloudflare Turnstile siteverify returns success:false with error-codes on failure; documented codes at https://developers.cloudflare.com/turnstile/. The applying project needs a stable refusal shape that never leaks the sitekey or the secret.",
+  "decision": "Refuse-if-token-missing status is 400. Refusal body carries a stable error-code (turnstile.token-missing for the guard branch, or the Cloudflare error-codes first entry for the siteverify-failure branch). Refusal body never carries the sitekey, the secret or the response token value. Standards trace clause: Cloudflare Turnstile documented error codes.",
+  "consequences": "The 400 status is machine-observable at every applied surface; downstream observability records the outcome by error-code, not by sitekey. Event records ship sitekeyHash, outcome and timestamp only (event-secrecy probe asserts this).",
+  "adrId": "ADR-3603-edge-cloudflare-turnstile-refuse-shape",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "proposed",
+  "title": "Refuse-if-token-missing status is 400 with an error-code body (no sitekey leak); siteverify failure carries the documented error-codes value"
+}

package/rcf/adrs/adr-3701-edge-cloudflare-rate-limiting-throttle-contract.json

@@ -0,0 +1,13 @@
+{
+  "createdAt": "2026-09-07T21:40:46.232Z",
+  "updatedAt": "2026-09-07T21:40:46.232Z",
+  "context": "T-6 repo-chain ADR mirror for the shipped blueprints/edge-cloudflare-rate-limiting/contributions/adrs/adr-3701-edge-cloudflare-rate-limiting-throttle-contract.json contribution. An applying Workers project needs a zone-level guard that refuses over-threshold bursts at the CF edge before they reach the origin. Cloudflare's WAF rate-limiting rules provide the native answer with a documented rule shape (id, expression, threshold, period, characteristics, action, duration) per https://developers.cloudflare.com/waf/rate-limiting-rules/. Every applied Worker needs one project-wide answer to the edgeThrottleContract topic; a future non-Cloudflare edge-throttle sibling would conflict on the same topic.",
+  "decision": "The shipped v1.0.0 default is Cloudflare WAF rate-limiting rules as the zone-level edge throttle. The rule shape matches the Cloudflare documented fields. The edgeThrottleContract topic scope is global on this blueprint. Standards trace clause: Cloudflare WAF rate-limiting rules documented shape.",
+  "consequences": "The applying project inherits Cloudflare's documented rule shape and platform-imposed limits. Rule state lives on the Cloudflare account, not in the git tree; the local manifest under cloudflare/rate-limits/ is the source of truth. Drift risk is addressed via ADR-3704 (cadence) and TAC-3703 (drift-audit runner).",
+  "adrId": "ADR-3701-edge-cloudflare-rate-limiting-throttle-contract",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "proposed",
+  "title": "Edge throttle contract: Cloudflare WAF rate-limiting rules (scope global, new topic edgeThrottleContract)"
+}

package/rcf/adrs/adr-3702-edge-cloudflare-rate-limiting-layering.json

@@ -0,0 +1,13 @@
+{
+  "createdAt": "2026-09-07T21:40:46.520Z",
+  "updatedAt": "2026-09-07T21:40:46.520Z",
+  "context": "T-6 repo-chain ADR mirror for the shipped blueprints/edge-cloudflare-rate-limiting/contributions/adrs/adr-3702-edge-cloudflare-rate-limiting-layering.json contribution. The security-auth-magic-link blueprint ships a per-email per-minute application-level rate limiter on the mint surface; edge-cloudflare-rate-limiting ships a zone-level IP-per-URL rate rule at the CF edge. Without an explicit layering ADR the operator can mistake the two rules for overlapping.",
+  "decision": "When both blueprints apply, the zone rule sits at the CF edge and refuses the (N+1)th request for the elicited duration before it reaches the origin; the magic-link per-email rate limiter continues at the mint-surface. The two rules operate on different characteristic sets (IP-per-URL vs per-email per-minute) and are additive. recommendedDefault: true. Standards trace clause: generic enterprise practice.",
+  "consequences": "The composition is documented in the guide with a copy-paste example. The applied recorder records both blueprints so the operator sees the two-rule shape at apply time; drift into overlap is caught in the drift-audit runner.",
+  "adrId": "ADR-3702-edge-cloudflare-rate-limiting-layering",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "proposed",
+  "title": "Layering with security-auth-magic-link: zone rule OVER the per-email application rule"
+}

package/rcf/adrs/adr-3703-edge-cloudflare-rate-limiting-manifest-shape.json

@@ -0,0 +1,13 @@
+{
+  "createdAt": "2026-09-07T21:40:46.808Z",
+  "updatedAt": "2026-09-07T21:40:46.808Z",
+  "context": "T-6 repo-chain ADR mirror for the shipped blueprints/edge-cloudflare-rate-limiting/contributions/adrs/adr-3703-edge-cloudflare-rate-limiting-manifest-shape.json contribution. The rule set could be committed as a wrangler-shape script, a bespoke apply tool, a single manifest file, or one file per rule. Single-file hides diff signal when one rule changes; committed script couples the source of truth to a specific tool.",
+  "decision": "The manifest lives at the elicited rate-limit-rules-dir (default cloudflare/rate-limits/), with one JSON file per rule. No committed script writes rules to the live zone; the operator applies through the documented wrangler or dashboard flow per REQ-101 and TAC-3702. recommendedDefault: true. Standards trace clause: generic enterprise practice.",
+  "consequences": "One-file-per-rule keeps each rule diff scoped. No committed apply script means the blueprint does not couple to a tool version and does not require an API token at build time. Operator applies at their chosen cadence; drift risk is addressed via ADR-3704 and TAC-3703.",
+  "adrId": "ADR-3703-edge-cloudflare-rate-limiting-manifest-shape",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "proposed",
+  "title": "Manifest at cloudflare/rate-limits/, one JSON file per rule; operator applies via wrangler or dashboard"
+}

package/rcf/adrs/adr-3704-edge-cloudflare-rate-limiting-drift-audit-cadence.json

@@ -0,0 +1,13 @@
+{
+  "createdAt": "2026-09-07T21:40:47.096Z",
+  "updatedAt": "2026-09-07T21:40:47.096Z",
+  "context": "T-6 repo-chain ADR mirror for the shipped blueprints/edge-cloudflare-rate-limiting/contributions/adrs/adr-3704-edge-cloudflare-rate-limiting-drift-audit-cadence.json contribution. Rate-limit rules live on the Cloudflare account, not in the git tree. Drift in either direction (dashboard change without manifest update, manifest edit without an apply) is only surfaced if the applying project runs the drift-audit runner at a cadence.",
+  "decision": "The drift-audit cadence is elicited (rate-limit-drift-audit-cadence) with three options: off (disables the runner), daily (24-hour cadence), hourly (60-minute cadence). recommendedDefault: daily. elicited: true. Standards trace clause: generic enterprise practice.",
+  "consequences": "daily is safe for typical operations; hourly is safe for high-cadence rule changes; off is safe only when the operator has an alternative drift-check discipline. The elicit prompts at apply time.",
+  "adrId": "ADR-3704-edge-cloudflare-rate-limiting-drift-audit-cadence",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "proposed",
+  "title": "Drift-audit cadence: off, daily or hourly (elicited; recommendedDefault daily)"
+}

package/rcf/code-nodes/cn-206.json

@@ -0,0 +1,14 @@
+{
+  "cnId": "CN-206",
+  "path": "../../blueprints/messaging-queue-cloudflare/blueprint.json",
+  "implementsAcIds": [
+    "AC-4201-1",
+    "AC-4201-2",
+    "AC-4201-3"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-06T19:19:10.538Z",
+  "updatedAt": "2026-09-06T19:19:10.538Z"
+}

package/rcf/code-nodes/cn-207.json

@@ -0,0 +1,13 @@
+{
+  "cnId": "CN-207",
+  "path": "../../blueprints/messaging-queue-cloudflare/contributions/probes/producer-facade-ready.mjs",
+  "implementsAcIds": [
+    "AC-4201-4",
+    "AC-4201-5"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-06T19:19:10.918Z",
+  "updatedAt": "2026-09-06T19:19:10.918Z"
+}

package/rcf/code-nodes/cn-208.json

@@ -0,0 +1,14 @@
+{
+  "cnId": "CN-208",
+  "path": "../../packages/rcf-lite/test/fixtures/infra-s3-and-queue/src/producer.mjs",
+  "implementsAcIds": [
+    "AC-4201-4",
+    "AC-4201-5",
+    "AC-4201-6"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-06T19:19:11.278Z",
+  "updatedAt": "2026-09-06T19:19:11.278Z"
+}

package/rcf/code-nodes/cn-209.json

@@ -0,0 +1,14 @@
+{
+  "cnId": "CN-209",
+  "path": "../../blueprints/deploy-cloudflare-workers/contributions/probes/assets-manifest-scan.mjs",
+  "implementsAcIds": [
+    "AC-2901-2",
+    "AC-2902-2",
+    "AC-3001-3"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-07T09:13:02.458Z",
+  "updatedAt": "2026-09-07T09:13:02.458Z"
+}

package/rcf/code-nodes/cn-210.json

@@ -0,0 +1,13 @@
+{
+  "cnId": "CN-210",
+  "path": "../../blueprints/deploy-cloudflare-workers/blueprint.json",
+  "implementsAcIds": [
+    "AC-2901-1",
+    "AC-2902-1"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-07T09:24:55.956Z",
+  "updatedAt": "2026-09-07T09:24:55.956Z"
+}

package/rcf/code-nodes/cn-211.json

@@ -0,0 +1,12 @@
+{
+  "cnId": "CN-211",
+  "path": "test/blueprint/deploy-cloudflare-workers-v-1-2-0-anatomy.test.js",
+  "implementsAcIds": [
+    "AC-2901-3"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-07T09:24:56.130Z",
+  "updatedAt": "2026-09-07T09:24:56.130Z"
+}

package/rcf/code-nodes/cn-212.json

@@ -0,0 +1,12 @@
+{
+  "cnId": "CN-212",
+  "path": "../../blueprints/deploy-cloudflare-workers/contributions/adrs/adr-1306-deploy-cloudflare-workers-spa-shape.json",
+  "implementsAcIds": [
+    "AC-3001-1"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-07T09:24:56.304Z",
+  "updatedAt": "2026-09-07T09:24:56.304Z"
+}

package/rcf/code-nodes/cn-213.json

@@ -0,0 +1,12 @@
+{
+  "cnId": "CN-213",
+  "path": "../../blueprints/deploy-cloudflare-workers/guide/deploy-cloudflare-workers.md",
+  "implementsAcIds": [
+    "AC-3001-2"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-07T09:24:56.479Z",
+  "updatedAt": "2026-09-07T09:24:56.479Z"
+}

package/rcf/code-nodes/cn-214.json

@@ -0,0 +1,15 @@
+{
+  "cnId": "CN-214",
+  "path": "../../blueprints/jobs-background/blueprint.json",
+  "implementsAcIds": [
+    "AC-4301-1",
+    "AC-4301-2",
+    "AC-4301-3",
+    "AC-4301-4"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-07T10:16:40.294Z",
+  "updatedAt": "2026-09-07T10:16:40.294Z"
+}

package/rcf/code-nodes/cn-215.json

@@ -0,0 +1,13 @@
+{
+  "cnId": "CN-215",
+  "path": "../../blueprints/jobs-background/contributions/probes/apply-time-refusal.mjs",
+  "implementsAcIds": [
+    "AC-4301-2",
+    "AC-4301-5"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-07T10:16:40.671Z",
+  "updatedAt": "2026-09-07T10:16:40.671Z"
+}

package/rcf/code-nodes/cn-216.json

@@ -0,0 +1,14 @@
+{
+  "cnId": "CN-216",
+  "path": "../../packages/rcf-lite/test/fixtures/infra-s3-and-queue/src/jobs-runtime.mjs",
+  "implementsAcIds": [
+    "AC-4301-5",
+    "AC-4301-6",
+    "AC-4301-7"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-07T10:16:41.065Z",
+  "updatedAt": "2026-09-07T10:16:41.065Z"
+}

package/rcf/code-nodes/cn-217.json

@@ -0,0 +1,13 @@
+{
+  "cnId": "CN-217",
+  "path": "../../packages/rcf-lite/src/blueprint/apply.js",
+  "implementsAcIds": [
+    "AC-4301-3",
+    "AC-4301-4"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-07T10:16:41.456Z",
+  "updatedAt": "2026-09-07T10:16:41.456Z"
+}

package/rcf/code-nodes/cn-230.json

@@ -0,0 +1,13 @@
+{
+  "cnId": "CN-230",
+  "path": "../../blueprints/platform-cloudflare-kv/blueprint.json",
+  "implementsAcIds": [
+    "AC-5001-1",
+    "AC-5002-1"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-07T10:21:02.415Z",
+  "updatedAt": "2026-09-07T10:21:02.415Z"
+}

package/rcf/code-nodes/cn-231.json

@@ -0,0 +1,14 @@
+{
+  "cnId": "CN-231",
+  "path": "../../packages/rcf-lite/test/fixtures/cf-platform/src/kv-facade.mjs",
+  "implementsAcIds": [
+    "AC-5001-1",
+    "AC-5002-1",
+    "AC-5301-1"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-07T10:21:02.591Z",
+  "updatedAt": "2026-09-07T10:21:02.591Z"
+}

package/rcf/code-nodes/cn-232.json

@@ -0,0 +1,13 @@
+{
+  "cnId": "CN-232",
+  "path": "../../packages/rcf-lite/test/fixtures/cf-platform/src/cache-aside.mjs",
+  "implementsAcIds": [
+    "AC-5201-1",
+    "AC-5201-2"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-07T10:21:02.776Z",
+  "updatedAt": "2026-09-07T10:21:02.776Z"
+}

package/rcf/code-nodes/cn-233.json

@@ -0,0 +1,14 @@
+{
+  "cnId": "CN-233",
+  "path": "../../blueprints/platform-cloudflare-kv/contributions/probes/facade-round-trip.mjs",
+  "implementsAcIds": [
+    "AC-5101-1",
+    "AC-5101-2",
+    "AC-5102-1"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-07T10:21:02.953Z",
+  "updatedAt": "2026-09-07T10:21:02.953Z"
+}

package/rcf/code-nodes/cn-234.json

@@ -0,0 +1,13 @@
+{
+  "cnId": "CN-234",
+  "path": "../../blueprints/platform-cloudflare-kv/contributions/probes/event-secrecy.mjs",
+  "implementsAcIds": [
+    "AC-5302-1",
+    "AC-5401-1"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-07T10:21:03.129Z",
+  "updatedAt": "2026-09-07T10:21:03.129Z"
+}

package/rcf/code-nodes/cn-260.json

@@ -0,0 +1,21 @@
+{
+  "cnId": "CN-260",
+  "path": "../../blueprints/platform-cloudflare-cron-triggers/blueprint.json",
+  "implementsAcIds": [
+    "AC-6001-1",
+    "AC-6002-1",
+    "AC-6003-1",
+    "AC-6101-1",
+    "AC-6101-2",
+    "AC-6201-1",
+    "AC-6201-2",
+    "AC-6301-1",
+    "AC-6301-2",
+    "AC-6302-1"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-07T12:30:06.513Z",
+  "updatedAt": "2026-09-07T12:30:06.513Z"
+}

package/rcf/code-nodes/cn-261.json

@@ -0,0 +1,14 @@
+{
+  "cnId": "CN-261",
+  "path": "../../packages/rcf-lite/test/fixtures/cf-platform/src/scheduled.mjs",
+  "implementsAcIds": [
+    "AC-6001-1",
+    "AC-6002-1",
+    "AC-6003-1"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-07T12:30:06.692Z",
+  "updatedAt": "2026-09-07T12:30:06.692Z"
+}

package/rcf/code-nodes/cn-262.json

@@ -0,0 +1,18 @@
+{
+  "cnId": "CN-262",
+  "path": "../../packages/rcf-lite/test/fixtures/cf-platform/src/dispatcher.mjs",
+  "implementsAcIds": [
+    "AC-6101-1",
+    "AC-6101-2",
+    "AC-6201-1",
+    "AC-6201-2",
+    "AC-6301-1",
+    "AC-6301-2",
+    "AC-6302-1"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-07T12:30:06.871Z",
+  "updatedAt": "2026-09-07T12:30:06.871Z"
+}

package/rcf/code-nodes/cn-263.json

@@ -0,0 +1,12 @@
+{
+  "cnId": "CN-263",
+  "path": "../../blueprints/platform-cloudflare-cron-triggers/contributions/probes/wrangler-test-scheduled.mjs",
+  "implementsAcIds": [
+    "AC-6002-1"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-07T12:30:07.051Z",
+  "updatedAt": "2026-09-07T12:30:07.051Z"
+}

package/rcf/code-nodes/cn-264.json

@@ -0,0 +1,13 @@
+{
+  "cnId": "CN-264",
+  "path": "../../blueprints/platform-cloudflare-cron-triggers/contributions/probes/dispatcher-routing.mjs",
+  "implementsAcIds": [
+    "AC-6101-1",
+    "AC-6101-2"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-07T12:30:07.230Z",
+  "updatedAt": "2026-09-07T12:30:07.230Z"
+}

package/rcf/code-nodes/cn-265.json

@@ -0,0 +1,15 @@
+{
+  "cnId": "CN-265",
+  "path": "../../blueprints/platform-cloudflare-cron-triggers/contributions/probes/skew-tolerance.mjs",
+  "implementsAcIds": [
+    "AC-6201-1",
+    "AC-6201-2",
+    "AC-6301-1",
+    "AC-6301-2"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-07T12:30:07.420Z",
+  "updatedAt": "2026-09-07T12:30:07.420Z"
+}

package/rcf/code-nodes/cn-266.json

@@ -0,0 +1,12 @@
+{
+  "cnId": "CN-266",
+  "path": "../../blueprints/platform-cloudflare-cron-triggers/contributions/probes/event-secrecy.mjs",
+  "implementsAcIds": [
+    "AC-6302-1"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-07T12:30:07.601Z",
+  "updatedAt": "2026-09-07T12:30:07.601Z"
+}

package/rcf/code-nodes/cn-267.json

@@ -0,0 +1,12 @@
+{
+  "cnId": "CN-267",
+  "path": "../../blueprints/platform-cloudflare-cron-triggers/contributions/probes/real-account-scheduled-smoke.mjs",
+  "implementsAcIds": [
+    "AC-6003-1"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-07T12:30:07.781Z",
+  "updatedAt": "2026-09-07T12:30:07.781Z"
+}

package/rcf/code-nodes/cn-290.json

@@ -0,0 +1,21 @@
+{
+  "cnId": "CN-290",
+  "path": "../../blueprints/platform-cloudflare-durable-objects/blueprint.json",
+  "implementsAcIds": [
+    "AC-7001-1",
+    "AC-7002-1",
+    "AC-7101-1",
+    "AC-7201-1",
+    "AC-7301-1",
+    "AC-7401-1",
+    "AC-7402-1",
+    "AC-7501-1",
+    "AC-7601-1",
+    "AC-7701-1"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-07T14:14:56.717Z",
+  "updatedAt": "2026-09-07T14:14:56.717Z"
+}

package/rcf/code-nodes/cn-291.json

@@ -0,0 +1,12 @@
+{
+  "cnId": "CN-291",
+  "path": "../../packages/rcf-lite/test/fixtures/cf-platform/wrangler.toml",
+  "implementsAcIds": [
+    "AC-7701-1"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-07T14:14:56.902Z",
+  "updatedAt": "2026-09-07T14:14:56.902Z"
+}

package/rcf/code-nodes/cn-292.json

@@ -0,0 +1,13 @@
+{
+  "cnId": "CN-292",
+  "path": "../../packages/rcf-lite/test/fixtures/cf-platform/src/do-facade.mjs",
+  "implementsAcIds": [
+    "AC-7001-1",
+    "AC-7601-1"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-07T14:14:57.089Z",
+  "updatedAt": "2026-09-07T14:14:57.089Z"
+}

package/rcf/code-nodes/cn-293.json

@@ -0,0 +1,13 @@
+{
+  "cnId": "CN-293",
+  "path": "../../packages/rcf-lite/test/fixtures/cf-platform/src/do-single-cell.mjs",
+  "implementsAcIds": [
+    "AC-7101-1",
+    "AC-7301-1"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-07T14:14:57.275Z",
+  "updatedAt": "2026-09-07T14:14:57.275Z"
+}