rcf-lite 0.22.0 → 0.24.0

package/rcf/user-stories/us-9201.json

@@ -0,0 +1,27 @@
+{
+  "createdAt": "2026-09-07T19:56:36.233Z",
+  "updatedAt": "2026-09-07T19:56:39.716Z",
+  "asA": "shelf consumer whose Worker refuses cheap submit-without-token attempts at the earliest possible boundary",
+  "iWant": "the guard to reject every submit whose payload has no Cf-Turnstile-Response field with 400 before the downstream handler is entered",
+  "soThat": "downstream handlers never execute against a missing-token submit",
+  "usId": "US-9201",
+  "prdId": "PRD-001",
+  "reqId": "REQ-092",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-5 refuse-if-token-missing guard: a submit without Cf-Turnstile-Response rejects with 400 before any downstream logic",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-9201-1",
+      "description": "A source-tree scan of the pack fixture (guard-shape-scan) enumerates every elicited surface and asserts each carries a token-required guard registered at the route level. A live POST to /api/submit without a Cf-Turnstile-Response field is rejected with 400 and no downstream handler side-effect is observable. Refusal body carries a stable error-code, not the sitekey.",
+      "given": "the pack fixture running with every elicited surface registered",
+      "when": "a submit reaches the route without a Cf-Turnstile-Response value",
+      "then": "the guard rejects with 400 with an error-code body and no downstream handler runs",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3602-edge-cloudflare-turnstile-server-verifier"
+  ]
+}

package/rcf/user-stories/us-9301.json

@@ -0,0 +1,27 @@
+{
+  "createdAt": "2026-09-07T19:56:36.636Z",
+  "updatedAt": "2026-09-07T19:56:39.901Z",
+  "asA": "shelf consumer applying both security-auth-magic-link and edge-cloudflare-turnstile",
+  "iWant": "the magic-link mint surface to be gated by the Turnstile guard so a mint submit reads through the same token check as any other elicited surface",
+  "soThat": "magic-link mint requests are protected by the same human-check as any other public form on my project",
+  "usId": "US-9301",
+  "prdId": "PRD-001",
+  "reqId": "REQ-093",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-5 composition with security-auth-magic-link: the magic-link mint surface reads through the Turnstile guard",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-9301-1",
+      "description": "The blueprint contribution ADR-3601 declares the composition contract on the humanVerificationGate topic; the pack fixture ships a magic-link mint stub route (/api/magic-link) registered with the Turnstile guard. A source-tree read of the composition wire confirms the mint surface calls through the Turnstile guard before invoking the magic-link mint.",
+      "given": "the pack fixture with both blueprints applied and /api/magic-link registered with the token-required guard",
+      "when": "the composition contract is walked in the source tree",
+      "then": "the magic-link mint surface reads the Turnstile token check before invoking the mint",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3603-edge-cloudflare-turnstile-magic-link-hook"
+  ]
+}

package/rcf/user-stories/us-9302.json

@@ -0,0 +1,27 @@
+{
+  "createdAt": "2026-09-07T19:56:37.055Z",
+  "updatedAt": "2026-09-07T19:56:40.090Z",
+  "asA": "shelf consumer relying on the composition to gate magic-link mint attempts",
+  "iWant": "a magic-link mint POST that carries no Turnstile response, or a mint POST whose Turnstile response fails siteverify, to be refused with 400 before the mint fires",
+  "soThat": "no magic-link is minted for a submitter who did not complete a Turnstile challenge",
+  "usId": "US-9302",
+  "prdId": "PRD-001",
+  "reqId": "REQ-093",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-5 magic-link guard cross-cutting: a magic-link mint submit without a valid Turnstile token is refused with 400 before the mint fires",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-9302-1",
+      "description": "A live POST to /api/magic-link on the pack fixture without a Cf-Turnstile-Response field, and a POST carrying the always-fail response token, are both refused with 400 by the Turnstile guard and no magic-link is minted. The Playwright pack check AC-turnstile-magicLinkGuard drives this against the fixture with a real browser.",
+      "given": "the pack fixture running with both blueprints applied and a real Playwright browser driving the fixture",
+      "when": "a magic-link mint submit is issued without a Turnstile response, or with the always-fail response token",
+      "then": "the Turnstile guard refuses with 400 and no magic-link mint side-effect is observable",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3603-edge-cloudflare-turnstile-magic-link-hook"
+  ]
+}

package/rcf/user-stories/us-9401.json

@@ -0,0 +1,27 @@
+{
+  "createdAt": "2026-09-07T19:56:37.462Z",
+  "updatedAt": "2026-09-07T19:56:40.275Z",
+  "asA": "shelf consumer selecting a Turnstile widget mode for my project",
+  "iWant": "to elicit one of managed, non-interactive or invisible at apply time with managed as the recommendedDefault, and to see each mode render as Cloudflare documents",
+  "soThat": "my applied surface matches the operational profile the site needs (interactive challenge, always non-interactive, or invisible background check)",
+  "usId": "US-9401",
+  "prdId": "PRD-001",
+  "reqId": "REQ-094",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-5 widget mode elicit: managed, non-interactive and invisible each render per Cloudflare documented widget modes and the elicited default is managed",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-9401-1",
+      "description": "The blueprint elicit widget-mode contributes an enum with values managed, non-interactive and invisible; recommendedDefault managed. The pack fixture accepts ?mode=<managed|non-interactive|invisible> and mounts the widget with the pinned test sitekeys that match Cloudflare documented mode variants (sitekey 1x0000000000000000000000AA for interactive-pass, 1x0000000000000000000000BB for invisible-pass). Each mode renders the Turnstile iframe from challenges.cloudflare.com and no third-party origin.",
+      "given": "the pack fixture loaded with mode set to managed, non-interactive and invisible respectively",
+      "when": "each variant renders",
+      "then": "each renders the Turnstile widget from Cloudflare Turnstile origin only and no third-party script is loaded",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3601-edge-cloudflare-turnstile-widget-mount"
+  ]
+}

package/releases/releases.yaml

@@ -40,8 +40,28 @@
 # `npm install rcf-lite`.
 
 feedVersion: 1
-latest: "0.22.0"
+latest: "0.24.0"
 releases:
+  - version: "0.24.0"
+    date: "2026-09-08"
+    breaking: false
+    headlines:
+      - "rcf-lite 0.24.0 opens the Cloudflare line with six blueprints in one round: a Workers KV facade, cron triggers with an expression-router, durable objects covering strong-consistency and hibernatable WebSocket shapes, a Zero-Trust Access gate the admin console consumes, Turnstile with the pinned test keys running under a Playwright pack, and edge rate limiting with a committed manifest."
+      - "Each blueprint verifies against the real Cloudflare engine through node-only probes, and the admin console reads the Access-gate capability to switch its sign-in surface."
+      - "Also in this release: application-admin-console bumps 1.0.0 to 1.1.0 to consume the zeroTrustGate capability, and the authoring standard section 6a capability table gains seven new rows."
+    minAgentAction: null
+    notesUrl: "https://stravica.ai/docs/rcf/changelog/"
+
+  - version: "0.23.0"
+    date: "2026-09-07"
+    breaking: false
+    headlines:
+      - "rcf-lite 0.23.0 adds the infrastructure spine four blueprints wide: a Postgres store with a facade contract and forward-only migrations, an S3-shape object store with a Cloudflare R2 first adapter, a Cloudflare Queues producer and consumer with dead-letter semantics, and a background-jobs discipline that refuses to apply until a queue is applied."
+      - "Each blueprint verifies against the real engine with node-only probes, and the four surfaces compose through the capability mechanism the round-3 admin console shipped."
+      - "Also in this release: the deploy-cloudflare-workers blueprint bumps 1.1.0 to 1.2.0 to bless the Workers-with-static-assets shape as the SPA-on-Workers deploy shape, and a CLI stdout-flush fix so large outputs are not truncated at the pipe buffer."
+    minAgentAction: null
+    notesUrl: "https://stravica.ai/docs/rcf/changelog/"
+
   - version: "0.22.0"
     date: "2026-09-07"
     breaking: false

package/src/blueprint/apply.js

@@ -397,10 +397,13 @@ export async function applyBlueprint({ projectRoot, tree, source, displaySource,
             const flag = blueprint.requiresAppliedCapabilities?.allowSkipFlag ?? 'allow-no-auth-yet';
             const caps = (blueprint.requiresAppliedCapabilities?.capabilities ?? []).join(', ');
             // Predecessor-family prose is derived from the flag name so
-            // the note reads sensibly for both the auth override ("auth
-            // blueprint") and the secrets override ("secrets-management
-            // blueprint") without the runner learning the family list.
-            const family = flag.includes('secrets') ? 'secrets-management' : 'auth';
+            // the note reads sensibly for the auth override, the secrets
+            // override, and the queue override (infra round 5 T-4)
+            // without the runner learning the family list. New families
+            // extend by pattern-matching a substring of the flag name.
+            const family = flag.includes('secrets')
+              ? 'secrets-management'
+              : (flag.includes('queue') ? 'queue' : 'auth');
             return `no ${family} yet: applied under --${flag}; surfaces gated on ${caps} will refuse at runtime until a ${family} blueprint is applied.`;
           })()
         : undefined,

package/src/blueprint/capabilities.js

@@ -129,6 +129,31 @@ export function buildRefusalMessage({ slug, refusalMessageId, requiredCapabiliti
       `       rcf define blueprint add ${slug} --${allowSkipFlag}`,
     ].join('\n');
   }
+  if (refusalMessageId === 'jobs-background-no-queue') {
+    // Infra round 5 T-4 (spec 5.4, Baz decision 5). Names the shipped
+    // queue provider explicitly (messaging-queue-cloudflare v1.0.0) so
+    // an operator hitting the refusal has the shipped answer in hand
+    // without a shelf-wide grep. Q3 default per spec section 10: the
+    // refusal asserts both exit code AND stable message id.
+    return [
+      `[jobs-background-no-queue] ${slug} requires an applied blueprint declaring`,
+      `at least one of: ${requiredCapabilities.join(', ')}`,
+      `or an operator override with --${allowSkipFlag}.`,
+      `The shipped provider is messaging-queue-cloudflare (v1.0.0+); a future`,
+      `messaging-queue-postgres sibling (Baz decision 7) will provide the same`,
+      `capability when demand mints it.`,
+      '',
+      'Applied blueprints on this project:',
+      appliedBlock,
+      '',
+      'Suggested next steps:',
+      '  1. Apply messaging-queue-cloudflare first:',
+      '       rcf define blueprint add messaging-queue-cloudflare',
+      `  2. Or override for a scaffolding pass (records a note on the applied`,
+      `     sidecar so later validation flags the surface as not-yet-activated):`,
+      `       rcf define blueprint add ${slug} --${allowSkipFlag}`,
+    ].join('\n');
+  }
   if (refusalMessageId === 'object-storage-s3-no-secrets') {
     return [
       `[object-storage-s3-no-secrets] ${slug} requires an applied blueprint declaring`,

package/src/cli/blueprint.js

@@ -196,6 +196,12 @@ const OPTION_SPEC = {
   // with the credential-pair discipline the spec names, rather than
   // reusing the auth-flavoured flag.
   'allow-no-secrets-yet': { type: 'boolean' },
+  // Infra round 5 T-4 (spec 5.4, Baz decision 5): jobs-background
+  // declares allowSkipFlag "allow-no-queue-yet" so the override for
+  // its requiresAppliedCapabilities gate stays semantically aligned
+  // with the queue-capability discipline the spec names, rather than
+  // reusing the auth or secrets flavoured flags.
+  'allow-no-queue-yet': { type: 'boolean' },
   answer: { type: 'string', multiple: true },
   answers: { type: 'string' },
 };
@@ -346,7 +352,8 @@ export async function main(argv, deps = {}) {
       projectRoot, tree, source,
       namespaceOverride: parsed.values.namespace,
       allowNoAuthYet: parsed.values['allow-no-auth-yet'] === true
-        || parsed.values['allow-no-secrets-yet'] === true,
+        || parsed.values['allow-no-secrets-yet'] === true
+        || parsed.values['allow-no-queue-yet'] === true,
       elicitAnswers,
       customAuthReadLine,
       // Library-qualified resolves rewire the applied identity under