rcf-lite 0.22.0 → 0.24.0

package/blueprints/edge-cloudflare-access/blueprint.json

@@ -0,0 +1,197 @@
+{
+  "slug": "edge-cloudflare-access",
+  "version": "1.0.0",
+  "category": "edge",
+  "capabilities": [
+    "zeroTrustGate"
+  ],
+  "suggestedCompanions": [
+    {
+      "role": "logging",
+      "reason": "Every validate-pass, validate-reject and bypass event emits an audit record with metadata-only fields; a logging companion supplies the sink factory."
+    },
+    {
+      "role": "errorHandling",
+      "reason": "A JWKS fetch failure, a signature mismatch, an expired-JWT branch and a missing header each construct a rejection outcome; an error-handling companion supplies the record factory and the boundary."
+    },
+    {
+      "role": "secretsManagement",
+      "reason": "The paired break-glass service-auth secret and the JWKS-URL projection to production are stored in the operator's applied secretsManagement companion; the applied vault seam receives the elicited values at apply time and injects them at deploy."
+    }
+  ],
+  "elicits": [
+    {
+      "id": "access-application-host",
+      "prompt": "Cloudflare Access application hostname the Zero Trust policy is attached to (recommended for hostname-scoped applications). Supply this OR access-selfhosted-app-id.",
+      "kind": "string",
+      "default": ""
+    },
+    {
+      "id": "access-selfhosted-app-id",
+      "prompt": "Cloudflare Access self-hosted application id (recommended for API-managed applications). Supply this OR access-application-host.",
+      "kind": "string",
+      "default": ""
+    },
+    {
+      "id": "access-audience",
+      "prompt": "JWT audience tag the Access policy issues; the validator refuses tokens whose aud claim does not match this string.",
+      "kind": "string",
+      "default": ""
+    },
+    {
+      "id": "access-jwks-url",
+      "prompt": "JWKS endpoint URL the validator fetches keys from. Cloudflare Access publishes this at https://<team>.cloudflareaccess.com/cdn-cgi/access/certs.",
+      "kind": "string",
+      "default": ""
+    },
+    {
+      "id": "access-policy-shape",
+      "prompt": "Access policy shape per TAC-3503. email-domain restricts by @<domain>; service-token-only allows only the elicited bypass-service-auth pair; service-token-plus-email-domain permits both; group-membership binds to an identity-provider group claim (recommended for enterprise SSO).",
+      "kind": "enum",
+      "options": [
+        "email-domain",
+        "service-token-only",
+        "service-token-plus-email-domain",
+        "group-membership"
+      ],
+      "default": "email-domain"
+    },
+    {
+      "id": "access-bypass-service-auth-id",
+      "prompt": "Break-glass service-auth id (per ADR-3502 elicit-only; leave blank to disable break-glass). Recorded on rcf/blueprints/edge-cloudflare-access.applied.json; the paired secret goes through security-secrets-management.",
+      "kind": "string",
+      "default": ""
+    }
+  ],
+  "contributions": [
+    {
+      "id": "edge-cloudflare-access-REQ-001",
+      "kind": "req",
+      "path": "requirements/edge-cloudflare-access-req-001.json"
+    },
+    {
+      "id": "edge-cloudflare-access-REQ-002",
+      "kind": "req",
+      "path": "requirements/edge-cloudflare-access-req-002.json"
+    },
+    {
+      "id": "edge-cloudflare-access-REQ-003",
+      "kind": "req",
+      "path": "requirements/edge-cloudflare-access-req-003.json"
+    },
+    {
+      "id": "edge-cloudflare-access-REQ-004",
+      "kind": "req",
+      "path": "requirements/edge-cloudflare-access-req-004.json"
+    },
+    {
+      "id": "edge-cloudflare-access-REQ-005",
+      "kind": "req",
+      "path": "requirements/edge-cloudflare-access-req-005.json"
+    },
+    {
+      "id": "edge-cloudflare-access-REQ-006",
+      "kind": "req",
+      "path": "requirements/edge-cloudflare-access-req-006.json"
+    },
+    {
+      "id": "edge-cloudflare-access-US-34101",
+      "kind": "us",
+      "path": "user-stories/edge-cloudflare-access-us-34101.json"
+    },
+    {
+      "id": "edge-cloudflare-access-US-34102",
+      "kind": "us",
+      "path": "user-stories/edge-cloudflare-access-us-34102.json"
+    },
+    {
+      "id": "edge-cloudflare-access-US-34103",
+      "kind": "us",
+      "path": "user-stories/edge-cloudflare-access-us-34103.json"
+    },
+    {
+      "id": "edge-cloudflare-access-US-34104",
+      "kind": "us",
+      "path": "user-stories/edge-cloudflare-access-us-34104.json"
+    },
+    {
+      "id": "edge-cloudflare-access-US-34105",
+      "kind": "us",
+      "path": "user-stories/edge-cloudflare-access-us-34105.json"
+    },
+    {
+      "id": "edge-cloudflare-access-US-34106",
+      "kind": "us",
+      "path": "user-stories/edge-cloudflare-access-us-34106.json"
+    },
+    {
+      "id": "edge-cloudflare-access-US-34107",
+      "kind": "us",
+      "path": "user-stories/edge-cloudflare-access-us-34107.json"
+    },
+    {
+      "id": "edge-cloudflare-access-US-34108",
+      "kind": "us",
+      "path": "user-stories/edge-cloudflare-access-us-34108.json"
+    },
+    {
+      "id": "edge-cloudflare-access-US-34109",
+      "kind": "us",
+      "path": "user-stories/edge-cloudflare-access-us-34109.json"
+    },
+    {
+      "id": "TAC-3501-edge-cloudflare-access-jwt-validator",
+      "kind": "tac",
+      "path": "tacs/tac-3501-edge-cloudflare-access-jwt-validator.json"
+    },
+    {
+      "id": "TAC-3502-edge-cloudflare-access-application-declaration",
+      "kind": "tac",
+      "path": "tacs/tac-3502-edge-cloudflare-access-application-declaration.json"
+    },
+    {
+      "id": "TAC-3503-edge-cloudflare-access-policy-shape",
+      "kind": "tac",
+      "path": "tacs/tac-3503-edge-cloudflare-access-policy-shape.json"
+    },
+    {
+      "id": "TAC-3504-edge-cloudflare-access-audit-sink",
+      "kind": "tac",
+      "path": "tacs/tac-3504-edge-cloudflare-access-audit-sink.json"
+    },
+    {
+      "id": "ADR-3501-edge-cloudflare-access-jwt-gate",
+      "kind": "adr",
+      "path": "adrs/adr-3501-edge-cloudflare-access-jwt-gate.json",
+      "scope": "global",
+      "topic": "edgeAuthenticationGate",
+      "recommendedDefault": true,
+      "elicited": false,
+      "standardsTraceClause": "Cloudflare Access policy actions and rule selectors"
+    },
+    {
+      "id": "ADR-3502-edge-cloudflare-access-identity-provider",
+      "kind": "adr",
+      "path": "adrs/adr-3502-edge-cloudflare-access-identity-provider.json",
+      "recommendedDefault": false,
+      "elicited": true,
+      "standardsTraceClause": "generic enterprise practice"
+    },
+    {
+      "id": "ADR-3503-edge-cloudflare-access-policy-scope",
+      "kind": "adr",
+      "path": "adrs/adr-3503-edge-cloudflare-access-policy-scope.json",
+      "recommendedDefault": true,
+      "elicited": true,
+      "standardsTraceClause": "Cloudflare Access policy actions and rule selectors"
+    },
+    {
+      "id": "ADR-3504-edge-cloudflare-access-audit-retention",
+      "kind": "adr",
+      "path": "adrs/adr-3504-edge-cloudflare-access-audit-retention.json",
+      "recommendedDefault": true,
+      "elicited": false,
+      "standardsTraceClause": "generic enterprise practice"
+    }
+  ]
+}

package/blueprints/edge-cloudflare-access/contributions/adrs/adr-3501-edge-cloudflare-access-jwt-gate.json

@@ -0,0 +1,14 @@
+{
+  "adrId": "ADR-3501-edge-cloudflare-access-jwt-gate",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "accepted",
+  "title": "Edge authentication gate: Cloudflare Access Zero-Trust JWT-assertion gate (scope global, new topic edgeAuthenticationGate)",
+  "context": "An applying Workers project has one native edge-authentication answer today: Cloudflare Access. Access enforces the policy at the CF edge, mints a short-lived JWT signed with its own JWKS, and forwards the JWT to the origin Worker in the Cf-Access-Jwt-Assertion header per https://developers.cloudflare.com/cloudflare-one/policies/access/. Every applied Worker needs one project-wide answer to the edgeAuthenticationGate topic; a future non-Cloudflare sibling (Google Cloud IAP, AWS Verified Access, Duo Beyond) would conflict on the same topic.",
+  "decision": "The shipped v1.0.0 default is Cloudflare Access's Zero-Trust JWT-assertion gate. The JWT validator (TAC-3501) is the sole reader of the Cf-Access-Jwt-Assertion header and reduces the principal onto request.auth. The edgeAuthenticationGate topic scope is global on this blueprint; the topic string is edgeAuthenticationGate (lower camel case, one concept per topic, no version suffix). A future non-Cloudflare adapter would contribute the same topic string with a different answer, forcing a DELIBERATE conflict the operator resolves with a project-level ADR.",
+  "consequences": "The applying project inherits Cloudflare's documented Access policy model, the platform-assigned per-application limits and the JWT rotation cadence Access publishes at https://<team>.cloudflareaccess.com/cdn-cgi/access/certs. Standards trace clause: Cloudflare Access policy actions and rule selectors (per https://developers.cloudflare.com/cloudflare-one/policies/access/). Consumers deploying to a non-Cloudflare edge reach for a sibling adapter blueprint that would land as a v1.x minor on this shelf.",
+  "alternativesConsidered": [],
+  "createdAt": "2026-09-07T16:00:00.000Z",
+  "updatedAt": "2026-09-07T16:00:00.000Z"
+}

package/blueprints/edge-cloudflare-access/contributions/adrs/adr-3502-edge-cloudflare-access-identity-provider.json

@@ -0,0 +1,25 @@
+{
+  "adrId": "ADR-3502-edge-cloudflare-access-identity-provider",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "accepted",
+  "title": "Identity provider for the Access application is elicited (recommendedDefault null)",
+  "context": "Cloudflare Access supports many identity providers: One-Time PIN over email, Google, GitHub, Okta, Microsoft Entra ID, SAML, OIDC, mTLS. The choice is an enterprise-integration decision that the shelf cannot pick for the operator: a solo project may take One-Time PIN; a mid-market SaaS may take Google Workspace; a regulated enterprise may take an SSO federation via SAML/OIDC.",
+  "decision": "Identity provider is elicited (elicited: true). No recommended default: recommendedDefault is null. The applied-sidecar records the operator's answer; the guide's dashboard walk-through and API alternative both operate on the selected provider. The break-glass service-auth pair (ADR-3503's elicited posture) is still available regardless of the identity provider, so CI can hit the Worker on top of any provider choice.",
+  "consequences": "The elicitation forces an explicit operator answer at apply. A workspace that never sets an identity provider cannot apply the blueprint (recommendedDefault=null refuses on apply per the shelf norm). Standards trace clause: generic enterprise practice (per the sentinel; no vendor documentation constrains which identity provider a Cloudflare Access application must use).",
+  "alternativesConsidered": [
+    {
+      "name": "Default to One-Time PIN over email",
+      "summary": "Pick OTP as the shipped default so a fresh project applies without an elicitation answer.",
+      "reasonNotChosen": "OTP is a stopgap for prototypes and personal projects; shipping it as the default would push operators to accept it silently in production. Making the choice explicit at apply is the honest posture."
+    },
+    {
+      "name": "Bind to security-auth-* companion",
+      "summary": "Derive the identity provider from whichever security-auth-* blueprint is applied.",
+      "reasonNotChosen": "Cloudflare Access is a distinct identity boundary from a same-app security-auth-* (Clerk, Keycloak, OAuth2, magic-link); an operator running Clerk in the app and Google Workspace as the Access IdP is a legitimate composition. Inference here would surprise the operator."
+    }
+  ],
+  "createdAt": "2026-09-07T16:00:00.000Z",
+  "updatedAt": "2026-09-07T16:00:00.000Z"
+}

package/blueprints/edge-cloudflare-access/contributions/adrs/adr-3503-edge-cloudflare-access-policy-scope.json

@@ -0,0 +1,12 @@
+{
+  "adrId": "ADR-3503-edge-cloudflare-access-policy-scope",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "accepted",
+  "title": "Policy scope: application-level (recommended default) or per-path elicited",
+  "context": "A Cloudflare Access application binds to a hostname or self-hosted-app id and a set of paths. Policies attach at the application level (one policy protects every path) or per-path (different policies for /admin vs /public). Application-level scope is the most common shape and the least surprising; per-path scope is a legitimate answer for a mixed-audience surface.",
+  "decision": "The shipped recommendedDefault is application-level (recommendedDefault: true). The elicited alternative is per-path (elicited: true). The guide's dashboard walk-through covers both paths; the API alternative differs only in the path selector on the policy issuance call. Standards trace clause: Cloudflare Access policy actions and rule selectors (per https://developers.cloudflare.com/cloudflare-one/policies/access/).",
+  "consequences": "A fresh project applying the blueprint gets one application-level policy protecting every path (the simplest deployment); an operator opting into per-path scope elicits a route table and issues one policy per route selector. The validator does not branch on the scope at runtime (the Cloudflare edge enforces the policy).",
+  "alternativesConsidered": []
+}

package/blueprints/edge-cloudflare-access/contributions/adrs/adr-3504-edge-cloudflare-access-audit-retention.json

@@ -0,0 +1,12 @@
+{
+  "adrId": "ADR-3504-edge-cloudflare-access-audit-retention",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "accepted",
+  "title": "Audit retention window (metadata-only fields) is delegated to the applied logging companion",
+  "context": "The validator emits one audit event per outcome with the metadata-only shape {email, outcome, timestamp, path} per REQ-004. Long-term retention (7 days, 90 days, 7 years) is a compliance decision an application-level logging companion (observability-logging, or a dedicated audit-log blueprint) already answers; a per-blueprint retention window would duplicate the answer and diverge over time.",
+  "decision": "The audit event shape is frozen at the validator boundary; retention is delegated verbatim to the applied logging companion (suggestedCompanions[0]). The blueprint declares no retention policy of its own. Standards trace clause: generic enterprise practice (per the sentinel; the metadata-only shape is the blueprint's contribution, retention is the companion's).",
+  "consequences": "A workspace without a logging companion loses the audit events after the Worker context tears down (per Cloudflare Workers semantics); the guide names the trade at apply. A workspace with observability-logging v1.x applied inherits its retention window unchanged.",
+  "alternativesConsidered": []
+}

package/blueprints/edge-cloudflare-access/contributions/probes/admin-console-gate-surface.mjs

@@ -0,0 +1,100 @@
+// Probe: admin-console gate surface - the extended admin-console fixture flips its sign-in surface per applied capability set.
+// anchorAcId: AC-34108-1. accountBound: false.
+//
+// This probe drives the extended probe-pack-application-admin-console fixture over HTTP (no browser).
+// The fixture ships a /admin/sign-in route that renders one of two surfaces based on ?caps=:
+//   - with zeroTrustGate in the caps list: [data-surface=access-gated] + no [data-surface=local-login] +
+//     [data-role=principal-read] with the request.auth email
+//   - without zeroTrustGate: [data-surface=local-login] + no [data-surface=access-gated]
+// The probe boots the fixture server, hits both combinations, greps the DOM for the surface markers,
+// and asserts the mutually exclusive presence. The shipped pack check AC-21815-1 on
+// application-admin-console.pack.mjs is exercised end-to-end in the anatomy test (it uses Playwright);
+// this probe covers the DOM-shape guarantee without a browser dependency.
+
+import { spawn } from 'node:child_process';
+import { resolve, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+export const anchorAcId = 'AC-34108-1';
+export const accountBound = false;
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const FIXTURE = resolve(HERE, '..', '..', '..', '..', 'packages', 'rcf-lite', 'test', 'fixtures', 'probe-pack-application-admin-console');
+const BIND_CAP_MS = 8000;
+
+async function bootServer() {
+  const proc = spawn(process.execPath, ['server.js'], {
+    cwd: FIXTURE,
+    env: { ...process.env, PORT: '0' },
+    stdio: ['ignore', 'pipe', 'pipe'],
+  });
+  let url = null;
+  let stderrTail = '';
+  proc.stdout.on('data', (buf) => {
+    const s = buf.toString();
+    const match = s.match(/LISTENING\s+(\d+)/);
+    if (match && !url) url = `http://127.0.0.1:${match[1]}`;
+  });
+  proc.stderr.on('data', (b) => { stderrTail = (stderrTail + b.toString()).slice(-2000); });
+  const start = Date.now();
+  while (!url && Date.now() - start < BIND_CAP_MS) {
+    if (proc.exitCode !== null) break;
+    await new Promise((r) => setTimeout(r, 50));
+  }
+  return { proc, url, stderrTail };
+}
+
+async function fetchDom(url, caps) {
+  const target = `${url}/admin/sign-in?caps=${encodeURIComponent(caps)}`;
+  const res = await fetch(target);
+  return { status: res.status, body: await res.text(), target };
+}
+
+async function stop(proc) {
+  if (!proc || proc.killed) return;
+  try { proc.kill('SIGTERM'); } catch (_e) {}
+  await new Promise((r) => setTimeout(r, 300));
+  try { if (!proc.killed) proc.kill('SIGKILL'); } catch (_e) {}
+}
+
+export default async function runProbe() {
+  const { proc, url, stderrTail } = await bootServer();
+  if (!url) {
+    await stop(proc);
+    return { results: [{ anchorAcId: 'AC-34108-1', verdict: 'fail', detail: `admin-console fixture did not bind within ${BIND_CAP_MS}ms; stderr: ${stderrTail}` }] };
+  }
+  const results = [];
+  try {
+    // Gated combination
+    const gated = await fetchDom(url, 'principalDirectory,roleModel,auditLog,zeroTrustGate');
+    const gatedOk =
+      gated.status === 200 &&
+      gated.body.includes('data-surface="access-gated"') &&
+      !gated.body.includes('data-surface="local-login"') &&
+      gated.body.includes('data-role="principal-read"');
+    results.push({
+      anchorAcId: 'AC-34108-1',
+      verdict: gatedOk ? 'pass' : 'fail',
+      detail: gatedOk
+        ? `gated: HTTP 200 with data-surface=access-gated, no data-surface=local-login, data-role=principal-read present at ${gated.target}`
+        : `gated combination did not match; status=${gated.status} accessGatedPresent=${gated.body.includes('data-surface="access-gated"')} localLoginPresent=${gated.body.includes('data-surface="local-login"')} principalReadPresent=${gated.body.includes('data-role="principal-read"')}`,
+    });
+
+    // Fallback combination
+    const fallback = await fetchDom(url, 'principalDirectory,roleModel,auditLog');
+    const fallbackOk =
+      fallback.status === 200 &&
+      fallback.body.includes('data-surface="local-login"') &&
+      !fallback.body.includes('data-surface="access-gated"');
+    results.push({
+      anchorAcId: 'AC-34108-1',
+      verdict: fallbackOk ? 'pass' : 'fail',
+      detail: fallbackOk
+        ? `fallback: HTTP 200 with data-surface=local-login, no data-surface=access-gated at ${fallback.target}`
+        : `fallback combination did not match; status=${fallback.status} localLoginPresent=${fallback.body.includes('data-surface="local-login"')} accessGatedPresent=${fallback.body.includes('data-surface="access-gated"')}`,
+    });
+  } finally {
+    await stop(proc);
+  }
+  return { results };
+}

package/blueprints/edge-cloudflare-access/contributions/probes/audit-event-secrecy.mjs

@@ -0,0 +1,70 @@
+// Probe: audit event secrecy - 10 records after 5 pass + 5 reject, no forbidden substrings.
+// anchorAcId: AC-34106-1. accountBound: false.
+
+export const anchorAcId = 'AC-34106-1';
+export const accountBound = false;
+
+export default async function runProbe() {
+  const { bootFixtureJwks, loadValidator, fixtureEnv, FIXTURE_AUDIENCE, FIXTURE_ISSUER } = await import('./probe-utils.mjs');
+
+  const boot = await bootFixtureJwks();
+  const createAccessValidator = await loadValidator();
+
+  const sink = [];
+  const validator = createAccessValidator({ env: fixtureEnv(boot.jwksUrl), eventSink: (r) => sink.push(r) });
+
+  const tokens = [];
+  // 5 pass runs
+  for (let i = 0; i < 5; i++) {
+    const jwt = boot.signerMod.fixtureAccessJwt({
+      key: boot.key,
+      profile: { issuer: FIXTURE_ISSUER, audience: FIXTURE_AUDIENCE },
+      principal: { email: `user${i}@example.com`, sub: `user:u${i}`, groups: ['members'] },
+      ttlSec: 60,
+    });
+    tokens.push(jwt);
+    const req = new Request(`https://cf-edge.fixture/pass/${i}`, { headers: { 'Cf-Access-Jwt-Assertion': jwt } });
+    await validator.middleware(req);
+  }
+  // 5 reject runs (missing header)
+  for (let i = 0; i < 5; i++) {
+    const req = new Request(`https://cf-edge.fixture/reject/${i}`);
+    await validator.middleware(req);
+  }
+
+  const results = [];
+  const allowed = ['email', 'outcome', 'path', 'timestamp'];
+  const shapeOk = sink.length === 10 && sink.every((r) => Object.keys(r).sort().join(',') === allowed.join(','));
+  results.push({
+    anchorAcId: 'AC-34106-1',
+    verdict: shapeOk ? 'pass' : 'fail',
+    detail: shapeOk
+      ? `10 audit records, allowed keys only (${allowed.join(',')})`
+      : `unexpected sink shape; count=${sink.length} sample=${JSON.stringify(sink[0] ?? null)}`,
+  });
+
+  // No forbidden substrings across the serialised sink.
+  const serialised = JSON.stringify(sink);
+  const forbidden = [];
+  for (const jwt of tokens) {
+    const parts = jwt.split('.');
+    // Include full JWT, header segment, payload segment and signature segment individually.
+    for (const seg of [jwt, parts[0], parts[1], parts[2]]) {
+      if (seg && serialised.includes(seg)) forbidden.push(`token-segment len=${seg.length}`);
+    }
+  }
+  for (const header of ['Cf-Access-Jwt-Assertion', 'Authorization', 'CF-Access-Client-Id', 'CF-Access-Client-Secret']) {
+    if (serialised.includes(header)) forbidden.push(`header-name ${header}`);
+  }
+  const secrecyOk = forbidden.length === 0;
+  results.push({
+    anchorAcId: 'AC-34106-1',
+    verdict: secrecyOk ? 'pass' : 'fail',
+    detail: secrecyOk
+      ? `no forbidden substrings in the serialised sink; ran 5 pass + 5 reject; sink JSON bytes=${serialised.length}`
+      : `forbidden substrings found: ${JSON.stringify(forbidden)}`,
+  });
+
+  await boot.stop();
+  return { results };
+}

package/blueprints/edge-cloudflare-access/contributions/probes/jwt-validator-fixture.mjs

@@ -0,0 +1,63 @@
+// Probe: JWT validator - fixture-signed JWT validates and principal reduces onto request.auth.
+// anchorAcId: AC-34101-1. accountBound: false.
+
+export const anchorAcId = 'AC-34101-1';
+export const accountBound = false;
+
+export default async function runProbe() {
+  const { bootFixtureJwks, loadValidator, fixtureEnv, FIXTURE_AUDIENCE, FIXTURE_ISSUER } = await import('./probe-utils.mjs');
+
+  const boot = await bootFixtureJwks();
+  const createAccessValidator = await loadValidator();
+
+  const sink = [];
+  const validator = createAccessValidator({ env: fixtureEnv(boot.jwksUrl), eventSink: (r) => sink.push(r) });
+
+  const jwt = boot.signerMod.fixtureAccessJwt({
+    key: boot.key,
+    profile: { issuer: FIXTURE_ISSUER, audience: FIXTURE_AUDIENCE },
+    principal: { email: 'ada@example.com', sub: 'user:ada', groups: ['admins', 'shipping'] },
+    ttlSec: 60,
+  });
+
+  const req = new Request('https://cf-edge.fixture/protected', {
+    headers: { 'Cf-Access-Jwt-Assertion': jwt },
+  });
+  const outcome = await validator.middleware(req);
+  const results = [];
+
+  const principal = outcome.outcome?.principal;
+  const okShape =
+    outcome.rejected === false &&
+    principal &&
+    principal.email === 'ada@example.com' &&
+    principal.sub === 'user:ada' &&
+    Array.isArray(principal.groups) &&
+    principal.groups.length === 2 &&
+    req.auth &&
+    req.auth.email === 'ada@example.com';
+
+  results.push({
+    anchorAcId: 'AC-34101-1',
+    verdict: okShape ? 'pass' : 'fail',
+    detail: okShape
+      ? `validator resolved; principal reduces to {email:${principal.email}, sub:${principal.sub}, groups:${JSON.stringify(principal.groups)}}; request.auth attached; audit outcome=validated`
+      : `validator did not resolve as expected; outcome=${JSON.stringify(outcome)} request.auth=${JSON.stringify(req.auth ?? null)}`,
+  });
+
+  // Audit sink should hold one record, allowed keys only, outcome=validated.
+  const record = sink[sink.length - 1];
+  const allowed = new Set(['email', 'outcome', 'timestamp', 'path']);
+  const extraKeys = record ? Object.keys(record).filter((k) => !allowed.has(k)) : ['(no record)'];
+  const auditOk = sink.length === 1 && record && record.outcome === 'validated' && record.email === 'ada@example.com' && record.path === '/protected' && extraKeys.length === 0;
+  results.push({
+    anchorAcId: 'AC-34101-1',
+    verdict: auditOk ? 'pass' : 'fail',
+    detail: auditOk
+      ? `one audit record with allowed keys only; outcome=validated email=${record.email} path=${record.path}`
+      : `unexpected audit shape; count=${sink.length} record=${JSON.stringify(record ?? null)} extraKeys=${JSON.stringify(extraKeys)}`,
+  });
+
+  await boot.stop();
+  return { results };
+}

package/blueprints/edge-cloudflare-access/contributions/probes/jwt-validator-reject.mjs

@@ -0,0 +1,95 @@
+// Probe: JWT validator reject cases - missing, expired, mis-signed each return 401 with metadata-only audit event.
+// anchorAcId: AC-34102-1. accountBound: false.
+
+export const anchorAcId = 'AC-34102-1';
+export const accountBound = false;
+
+export default async function runProbe() {
+  const { bootFixtureJwks, loadValidator, fixtureEnv, FIXTURE_AUDIENCE, FIXTURE_ISSUER } = await import('./probe-utils.mjs');
+
+  const boot = await bootFixtureJwks();
+  const createAccessValidator = await loadValidator();
+
+  const results = [];
+  const subcases = [];
+
+  // 1. Missing header
+  {
+    const sink = [];
+    const validator = createAccessValidator({ env: fixtureEnv(boot.jwksUrl), eventSink: (r) => sink.push(r) });
+    const req = new Request('https://cf-edge.fixture/protected');
+    const outcome = await validator.middleware(req);
+    subcases.push({
+      name: 'missing',
+      rejected: outcome.rejected,
+      status: outcome.response?.status,
+      auditCount: sink.length,
+      auditOutcome: sink[0]?.outcome,
+      auditKeys: sink[0] ? Object.keys(sink[0]).sort() : null,
+    });
+  }
+
+  // 2. Expired (SIMULATE_EXPIRED_JWT flag forces the code path)
+  {
+    const sink = [];
+    const validator = createAccessValidator({ env: fixtureEnv(boot.jwksUrl), eventSink: (r) => sink.push(r) });
+    const jwt = boot.signerMod.fixtureAccessJwt({
+      key: boot.key,
+      profile: { issuer: FIXTURE_ISSUER, audience: FIXTURE_AUDIENCE },
+      principal: { email: 'grace@example.com', sub: 'user:grace' },
+      ttlSec: 60,
+    });
+    const req = new Request('https://cf-edge.fixture/protected', { headers: { 'Cf-Access-Jwt-Assertion': jwt } });
+    const outcome = await validator.middleware(req, { SIMULATE_EXPIRED_JWT: true });
+    subcases.push({
+      name: 'expired',
+      rejected: outcome.rejected,
+      status: outcome.response?.status,
+      auditCount: sink.length,
+      auditOutcome: sink[0]?.outcome,
+      auditKeys: sink[0] ? Object.keys(sink[0]).sort() : null,
+    });
+  }
+
+  // 3. Mis-signed: sign with a DIFFERENT key, JWKS only carries the fixture key.
+  {
+    const sink = [];
+    const validator = createAccessValidator({ env: fixtureEnv(boot.jwksUrl), eventSink: (r) => sink.push(r) });
+    const wrongKey = boot.signerMod.createFixtureKey(boot.key.kid); // same kid so JWKS lookup hits, but a different keypair
+    const jwt = boot.signerMod.fixtureAccessJwt({
+      key: wrongKey,
+      profile: { issuer: FIXTURE_ISSUER, audience: FIXTURE_AUDIENCE },
+      principal: { email: 'evil@example.com', sub: 'user:evil' },
+      ttlSec: 60,
+    });
+    const req = new Request('https://cf-edge.fixture/protected', { headers: { 'Cf-Access-Jwt-Assertion': jwt } });
+    const outcome = await validator.middleware(req);
+    subcases.push({
+      name: 'mis-signed',
+      rejected: outcome.rejected,
+      status: outcome.response?.status,
+      auditCount: sink.length,
+      auditOutcome: sink[0]?.outcome,
+      auditKeys: sink[0] ? Object.keys(sink[0]).sort() : null,
+    });
+  }
+
+  // Note the mutation-check pair for the negative fires:
+  // Fires on the shipped code path (no bypass): every rejected===true, status===401, auditCount===1, audit keys drawn from allowed set.
+  // A mutation that removes the sink.push()/early-return call in the missing branch would drop auditCount to 0 (subcase would fail).
+
+  const allowed = ['email', 'outcome', 'path', 'timestamp'];
+  for (const sc of subcases) {
+    const ok = sc.rejected === true && sc.status === 401 && sc.auditCount === 1 && sc.auditKeys && sc.auditKeys.join(',') === allowed.join(',');
+    results.push({
+      anchorAcId: 'AC-34102-1',
+      verdict: ok ? 'pass' : 'fail',
+      detail: ok
+        ? `subcase ${sc.name}: 401 with one audit event, allowed keys only (${sc.auditKeys.join(',')}), outcome=${sc.auditOutcome}`
+        : `subcase ${sc.name} broke: ${JSON.stringify(sc)}`,
+    });
+  }
+
+  await boot.stop();
+  return { results };
+}