rcf-lite 0.22.0 → 0.24.0

package/blueprints/edge-cloudflare-access/contributions/probes/probe-utils.mjs

@@ -0,0 +1,90 @@
+// Shared helpers for edge-cloudflare-access probes.
+//
+// Runtime-dependency posture: probes import the fixture's JWT
+// validator, fixture-JWT signer and JWKS server from the cf-edge
+// fixture src/ and test/ trees so rcf-lite itself gains no new
+// runtime dependency. Four probes drive the shipped code path
+// in-process; one probe (real-account-gated-url) opens a network
+// fetch against the elicited hostname when CI_HAS_CLOUDFLARE_ACCOUNT
+// and CF_ACCESS_HOST are set. Without both env vars it records
+// accountBoundSkipped and aggregates to pass per spec section 3.5.
+//
+// The wrangler dev seam is documented in the fixture README under
+// the "Two-line wrangler-seam boot" section; the wrangler-seam
+// probe drives it under workerd.
+
+import { mkdir, writeFile } from 'node:fs/promises';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+
+export const PROJECT_ROOT = resolve(HERE, '..', '..', '..', '..');
+export const FIXTURE_DIR = resolve(PROJECT_ROOT, 'packages/rcf-lite/test/fixtures/cf-edge');
+export const REPORT_DIR = resolve(PROJECT_ROOT, '.rcf/reports/blueprints/edge-cloudflare-access');
+
+export function aggregate(results) {
+  if (results.some((r) => r.verdict === 'fail')) return 'fail';
+  if (results.some((r) => r.verdict === 'warn')) return 'warn';
+  return 'pass';
+}
+
+export async function writeReport({ probeName, engine, results, extra }) {
+  await mkdir(REPORT_DIR, { recursive: true });
+  const report = {
+    slug: 'edge-cloudflare-access',
+    probeName,
+    runAt: new Date().toISOString(),
+    engine,
+    results,
+    aggregateVerdict: aggregate(results),
+    ...(extra ?? {}),
+  };
+  const path = resolve(REPORT_DIR, `${probeName}.json`);
+  await writeFile(path, JSON.stringify(report, null, 2) + '\n', 'utf8');
+  return { report, path };
+}
+
+// Wraps a probe's async main body and reports. Sets process.exitCode
+// on fail; drains stdout naturally per shelf convention.
+export async function runShim(probeName, engine, mainFn) {
+  try {
+    const { results, extra } = await mainFn();
+    const { report, path } = await writeReport({ probeName, engine, results, extra });
+    process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+    process.stdout.write(`report written to ${path}\n`);
+    if (report.aggregateVerdict === 'fail') process.exitCode = 1;
+  } catch (err) {
+    const results = [{
+      anchorAcId: 'unknown',
+      verdict: 'fail',
+      detail: `probe threw: ${err && err.message ? err.message : String(err)}`,
+    }];
+    const { report, path } = await writeReport({ probeName, engine, results });
+    process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+    process.stderr.write(`probe error: ${err && err.stack ? err.stack : String(err)}\n`);
+    process.stderr.write(`report written to ${path}\n`);
+    process.exitCode = 1;
+  }
+}
+
+// Boot a fixture JWT keypair + JWKS server on 127.0.0.1:0 and
+// return {key, server, jwksUrl, stop}.
+export async function bootFixtureJwks(kid = 'cf-edge-fixture-kid-1') {
+  const signerMod = await import(`${FIXTURE_DIR}/test/jwt-signer.mjs`);
+  const jwksMod = await import(`${FIXTURE_DIR}/test/jwks-server.mjs`);
+  const key = signerMod.createFixtureKey(kid);
+  const server = await jwksMod.startJwksServer({ port: 0, keys: [key] });
+  return { key, server, signerMod, jwksUrl: server.url, stop: () => server.stop() };
+}
+
+export async function loadValidator() {
+  return (await import(`${FIXTURE_DIR}/src/jwt-validator.mjs`)).createAccessValidator;
+}
+
+export function fixtureEnv(jwksUrl, audience = 'cf-edge-fixture-audience') {
+  return { ACCESS_JWKS_URL: jwksUrl, ACCESS_AUDIENCE: audience };
+}
+
+export const FIXTURE_AUDIENCE = 'cf-edge-fixture-audience';
+export const FIXTURE_ISSUER = 'https://cf-edge-fixture.cloudflareaccess.test';

package/blueprints/edge-cloudflare-access/contributions/probes/real-account-gated-url.mjs

@@ -0,0 +1,65 @@
+// Probe: real-account gated URL round-trip against a scheduled Access-configured hostname.
+// anchorAcId: AC-34109-1. accountBound: true.
+//
+// When CI_HAS_CLOUDFLARE_ACCOUNT and CF_ACCESS_HOST are set, the probe fetches
+// https://<host>/ with redirects disabled and walks up to five redirect hops,
+// asserting the terminal Location points at https://<team>.cloudflareaccess.com/.
+// Without either env var the probe records accountBoundSkipped: true and
+// aggregates to pass per spec section 3.5 (pass-with-skip).
+
+export const anchorAcId = 'AC-34109-1';
+export const accountBound = true;
+
+const MAX_HOPS = 5;
+
+async function walkRedirects(url) {
+  const chain = [];
+  let current = url;
+  for (let hop = 0; hop < MAX_HOPS; hop++) {
+    const res = await fetch(current, { redirect: 'manual' });
+    const location = res.headers.get('location');
+    chain.push({ url: current, status: res.status, location });
+    if (res.status < 300 || res.status >= 400 || !location) break;
+    current = new URL(location, current).toString();
+  }
+  return { chain, terminal: chain[chain.length - 1] };
+}
+
+export default async function runProbe() {
+  const has = process.env.CI_HAS_CLOUDFLARE_ACCOUNT === 'true';
+  const host = process.env.CF_ACCESS_HOST || '';
+  if (!has || !host) {
+    return {
+      results: [{
+        anchorAcId: 'AC-34109-1',
+        verdict: 'pass',
+        accountBoundSkipped: true,
+        detail: `accountBoundSkipped: CI_HAS_CLOUDFLARE_ACCOUNT=${has} CF_ACCESS_HOST=${host ? 'set' : 'unset'}; per spec section 3.5 pass-with-skip.`,
+      }],
+      extra: { accountBoundSkipped: true },
+    };
+  }
+  try {
+    const { chain, terminal } = await walkRedirects(`https://${host}/`);
+    const terminalUrl = terminal.location ?? terminal.url;
+    const ok = /https?:\/\/[a-z0-9-]+\.cloudflareaccess\.com/i.test(terminalUrl);
+    return {
+      results: [{
+        anchorAcId: 'AC-34109-1',
+        verdict: ok ? 'pass' : 'fail',
+        detail: ok
+          ? `redirect chain terminated at cloudflareaccess.com; hops=${chain.length} terminal=${terminalUrl}`
+          : `redirect chain did not terminate at cloudflareaccess.com; chain=${JSON.stringify(chain)}`,
+      }],
+      extra: { accountBound: true, chainLength: chain.length },
+    };
+  } catch (err) {
+    return {
+      results: [{
+        anchorAcId: 'AC-34109-1',
+        verdict: 'fail',
+        detail: `real-account probe threw: ${err && err.message ? err.message : String(err)}`,
+      }],
+    };
+  }
+}

package/blueprints/edge-cloudflare-access/contributions/probes/run-admin-console-gate-surface.mjs

@@ -0,0 +1,5 @@
+import runProbe from './admin-console-gate-surface.mjs';
+import { runShim } from './probe-utils.mjs';
+
+const engine = { kind: 'admin-console-fixture', image: 'node HTTP fixture (probe-pack-application-admin-console)', healthy: true };
+runShim('admin-console-gate-surface', engine, runProbe);

package/blueprints/edge-cloudflare-access/contributions/probes/run-audit-event-secrecy.mjs

@@ -0,0 +1,5 @@
+import runProbe from './audit-event-secrecy.mjs';
+import { runShim } from './probe-utils.mjs';
+
+const engine = { kind: 'in-process', image: 'in-process JWT validator on cf-edge fixture', healthy: true };
+runShim('audit-event-secrecy', engine, runProbe);

package/blueprints/edge-cloudflare-access/contributions/probes/run-jwt-validator-fixture.mjs

@@ -0,0 +1,5 @@
+import runProbe from './jwt-validator-fixture.mjs';
+import { runShim } from './probe-utils.mjs';
+
+const engine = { kind: 'in-process', image: 'in-process JWT validator on cf-edge fixture', healthy: true };
+runShim('jwt-validator-fixture', engine, runProbe);

package/blueprints/edge-cloudflare-access/contributions/probes/run-jwt-validator-reject.mjs

@@ -0,0 +1,5 @@
+import runProbe from './jwt-validator-reject.mjs';
+import { runShim } from './probe-utils.mjs';
+
+const engine = { kind: 'in-process', image: 'in-process JWT validator on cf-edge fixture', healthy: true };
+runShim('jwt-validator-reject', engine, runProbe);

package/blueprints/edge-cloudflare-access/contributions/probes/run-real-account-gated-url.mjs

@@ -0,0 +1,5 @@
+import runProbe from './real-account-gated-url.mjs';
+import { runShim } from './probe-utils.mjs';
+
+const engine = { kind: 'real-account', image: 'live fetch against Cloudflare Access-configured hostname', healthy: true };
+runShim('real-account-gated-url', engine, runProbe);

package/blueprints/edge-cloudflare-access/contributions/probes/run-wrangler-seam.mjs

@@ -0,0 +1,5 @@
+import runProbe from './wrangler-seam.mjs';
+import { runShim } from './probe-utils.mjs';
+
+const engine = { kind: 'wrangler-dev', image: 'wrangler dev (workerd) on cf-edge fixture', healthy: true };
+runShim('wrangler-seam', engine, runProbe);

package/blueprints/edge-cloudflare-access/contributions/probes/wrangler-seam.mjs

@@ -0,0 +1,203 @@
+// Wrangler-seam probe for edge-cloudflare-access v1.0.0.
+//
+// Spawns `wrangler dev --local` on the cf-edge fixture and drives
+// three requests to observe the JWT validator at the edge under
+// workerd:
+//
+// (a) a missing-header request to /protected returns HTTP 401
+//     (the validator's reject path runs through the shipped Worker
+//     entry, not through the in-process probes).
+// (b) a request to /protected carrying a fixture-signed JWT that
+//     the fixture JWKS server (booted by this probe on the fixed
+//     port from wrangler.toml [vars] ACCESS_JWKS_URL) validates
+//     returns HTTP 200 with request.auth reflected on the response
+//     body.
+// (c) a request to /health returns HTTP 200 (the /health path is
+//     exempt from the validator so a load balancer can reach it).
+//
+// Warn semantics per spec section 3.1 pass-with-skip:
+//   - wrangler devDependency missing: aggregateVerdict warn (never fail);
+//   - wrangler CLI fails to bind within the cap: warn.
+//   - A handler thrown at the workerd boundary: fail (per round-6 T-3 gate).
+//
+// Mutation-check pair for the negative fires: removing the
+// validator's early-return call on missing header would surface
+// the /protected request as HTTP 200 with no request.auth (an
+// unauthenticated request reaching the handler). The probe fails
+// on that mutation: HTTP 401 is required. See PR body for the
+// verbatim tails of the shipped-path pass and the mutation-run
+// fail.
+
+import { spawn } from 'node:child_process';
+import { existsSync } from 'node:fs';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+
+export const anchorAcId = 'AC-34101-1';
+export const accountBound = false;
+
+const BIND_CAP_MS = 60000;
+const KILL_GRACE_MS = 2000;
+// The fixture wrangler.toml [vars] ACCESS_JWKS_URL points at 127.0.0.1:8788
+// per the shipped file. The wrangler-seam probe boots the JWKS server on
+// exactly that port so the validator hits it under workerd.
+const JWKS_PORT = 8788;
+const FIXTURE_AUDIENCE = 'cf-edge-fixture-audience';
+const FIXTURE_ISSUER = 'https://cf-edge-fixture.cloudflareaccess.test';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const FIXTURE_DIR = resolve(HERE, '..', '..', '..', '..', 'packages', 'rcf-lite', 'test', 'fixtures', 'cf-edge');
+
+function findWranglerBin() {
+  const candidate = resolve(FIXTURE_DIR, 'node_modules', '.bin', 'wrangler');
+  return existsSync(candidate) ? candidate : null;
+}
+
+async function killAndDrain(proc) {
+  if (!proc || proc.killed) return;
+  try { proc.kill('SIGTERM'); } catch (_e) {}
+  await new Promise((r) => setTimeout(r, KILL_GRACE_MS));
+  try { if (!proc.killed) proc.kill('SIGKILL'); } catch (_e) {}
+}
+
+export default async function runProbe() {
+  const results = [];
+  const bin = findWranglerBin();
+  if (!bin) {
+    results.push({
+      anchorAcId: 'AC-34101-1',
+      verdict: 'warn',
+      detail: `wrangler devDependency not installed under ${FIXTURE_DIR}/node_modules/.bin/wrangler; run pnpm install --ignore-workspace in the fixture directory. Mechanism-reach gap noted; the in-process probes carry the runtime evidence for the shipped validator. Warn (not fail) per section 3.1 pass-with-skip.`,
+    });
+    return { results, extra: { wranglerBinPresent: false } };
+  }
+
+  // Boot the fixture JWKS server on the fixed port from wrangler.toml.
+  const signerMod = await import(pathToFileURL(resolve(FIXTURE_DIR, 'test', 'jwt-signer.mjs')).href);
+  const jwksMod = await import(pathToFileURL(resolve(FIXTURE_DIR, 'test', 'jwks-server.mjs')).href);
+  const key = signerMod.createFixtureKey('cf-edge-wrangler-seam-kid');
+  let jwks;
+  try {
+    jwks = await jwksMod.startJwksServer({ port: JWKS_PORT, keys: [key] });
+  } catch (err) {
+    results.push({
+      anchorAcId: 'AC-34101-1',
+      verdict: 'warn',
+      detail: `local JWKS server could not bind port ${JWKS_PORT}: ${err && err.message ? err.message : String(err)}. Warn (not fail): the JWKS port is required for the wrangler-seam probe to observe the validator's positive path under workerd. Fix by freeing port ${JWKS_PORT} and re-running.`,
+    });
+    return { results, extra: { wranglerBinPresent: true, jwksBound: false } };
+  }
+
+  const proc = spawn(bin, ['dev', '--local', '--port', '0'], {
+    cwd: FIXTURE_DIR,
+    env: process.env,
+    stdio: ['ignore', 'pipe', 'pipe'],
+  });
+
+  let boundUrl = null;
+  let stderrTail = '';
+  let stdoutTail = '';
+  proc.stdout.on('data', (buf) => {
+    const s = buf.toString();
+    stdoutTail = (stdoutTail + s).slice(-2000);
+    const m = s.match(/Ready on http:\/\/(?:127\.0\.0\.1|localhost):(\d+)/i);
+    if (m && !boundUrl) boundUrl = `http://127.0.0.1:${m[1]}`;
+  });
+  proc.stderr.on('data', (b) => { stderrTail = (stderrTail + b.toString()).slice(-2000); });
+
+  const start = Date.now();
+  while (!boundUrl && Date.now() - start < BIND_CAP_MS) {
+    if (proc.exitCode !== null) break;
+    await new Promise((r) => setTimeout(r, 250));
+  }
+
+  if (!boundUrl) {
+    await killAndDrain(proc);
+    await jwks.stop();
+    results.push({
+      anchorAcId: 'AC-34101-1',
+      verdict: 'warn',
+      detail: `wrangler dev did not bind within ${BIND_CAP_MS}ms; stdoutTail: ${stdoutTail.slice(-400)} stderrTail: ${stderrTail.slice(-400)}. Warn (not fail) per section 3.1 pass-with-skip.`,
+    });
+    return { results, extra: { wranglerBinPresent: true, boundUrl: null } };
+  }
+
+  try {
+    // (a) missing header on /protected -> 401
+    let statusMissing = 0;
+    try {
+      const r = await fetch(`${boundUrl}/protected`);
+      statusMissing = r.status;
+    } catch (err) {
+      results.push({
+        anchorAcId: 'AC-34101-1',
+        verdict: 'fail',
+        detail: `handler thrown at the workerd boundary on /protected: ${err && err.message ? err.message : String(err)}`,
+      });
+      return { results, extra: { wranglerBinPresent: true, boundUrl } };
+    }
+    results.push({
+      anchorAcId: 'AC-34101-1',
+      verdict: statusMissing === 401 ? 'pass' : 'fail',
+      detail: statusMissing === 401
+        ? `workerd /protected (no header) returned HTTP 401 - the shipped validator's missing-header reject path fires at the edge`
+        : `workerd /protected (no header) returned HTTP ${statusMissing}; expected 401 on the shipped validator's missing-header reject path (a value other than 401 would surface an unauthenticated request to the handler - the exact mutation the probe guards against)`,
+    });
+
+    // (b) valid fixture-signed JWT on /protected -> 200 with request.auth
+    const jwt = signerMod.fixtureAccessJwt({
+      key,
+      profile: { issuer: FIXTURE_ISSUER, audience: FIXTURE_AUDIENCE },
+      principal: { email: 'ada@example.com', sub: 'user:ada', groups: ['admins'] },
+      ttlSec: 60,
+    });
+    let signedStatus = 0;
+    let signedBody = '';
+    try {
+      const r = await fetch(`${boundUrl}/protected`, { headers: { 'Cf-Access-Jwt-Assertion': jwt } });
+      signedStatus = r.status;
+      signedBody = await r.text();
+    } catch (err) {
+      results.push({
+        anchorAcId: 'AC-34101-1',
+        verdict: 'fail',
+        detail: `handler thrown at the workerd boundary on signed /protected: ${err && err.message ? err.message : String(err)}`,
+      });
+      return { results, extra: { wranglerBinPresent: true, boundUrl } };
+    }
+    const authLeaked = signedStatus === 200 && signedBody.includes('"auth"') && signedBody.includes('"email":"ada@example.com"');
+    results.push({
+      anchorAcId: 'AC-34101-1',
+      verdict: authLeaked ? 'pass' : 'fail',
+      detail: authLeaked
+        ? `workerd /protected (fixture-signed JWT) returned HTTP 200 with request.auth reflected on the body (email=ada@example.com)`
+        : `workerd /protected (fixture-signed JWT) failed: status=${signedStatus} body=${signedBody.slice(0, 200)}`,
+    });
+
+    // (c) /health -> 200
+    let healthStatus = 0;
+    try {
+      const r = await fetch(`${boundUrl}/health`);
+      healthStatus = r.status;
+    } catch (err) {
+      results.push({
+        anchorAcId: 'AC-34101-1',
+        verdict: 'fail',
+        detail: `handler thrown at the workerd boundary on /health: ${err && err.message ? err.message : String(err)}`,
+      });
+      return { results, extra: { wranglerBinPresent: true, boundUrl } };
+    }
+    results.push({
+      anchorAcId: 'AC-34101-1',
+      verdict: healthStatus === 200 ? 'pass' : 'fail',
+      detail: healthStatus === 200
+        ? `workerd /health returned HTTP 200 (health path exempt from the validator, LB-reachable)`
+        : `workerd /health returned HTTP ${healthStatus}; expected 200`,
+    });
+  } finally {
+    await killAndDrain(proc);
+    await jwks.stop();
+  }
+
+  return { results, extra: { wranglerBinPresent: true, boundUrl } };
+}

package/blueprints/edge-cloudflare-access/contributions/requirements/edge-cloudflare-access-req-001.json

@@ -0,0 +1,17 @@
+{
+  "reqId": "edge-cloudflare-access-REQ-001",
+  "prdId": "PRD-001",
+  "title": "The Access JWT validator is the sole reader of the Cf-Access-Jwt-Assertion header and reduces the principal onto request.auth",
+  "description": "The applying project reaches Cloudflare Access through a single JWT validator module (src/jwt-validator.mjs) that is the ONLY module dereferencing the Cf-Access-Jwt-Assertion header in the applied source tree per https://developers.cloudflare.com/cloudflare-one/policies/access/. The validator fetches the Access JWKS from the elicited endpoint, caches keys per-kid, verifies the JWT against the cached key matching the header's kid, and reduces the principal into request.auth as {email, sub, groups}. Every downstream handler reads request.auth only; no other module reaches the header.",
+  "category": "functional",
+  "domain": "edge",
+  "priority": "must",
+  "rationale": "Ratified in the Cloudflare round 6 spec (2026-09-06 section 5.4). Ships as v1.0.0 of edge-cloudflare-access.",
+  "tags": [
+    "blueprint:edge-cloudflare-access"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-07T16:00:00.000Z",
+  "updatedAt": "2026-09-07T16:00:00.000Z"
+}

package/blueprints/edge-cloudflare-access/contributions/requirements/edge-cloudflare-access-req-002.json

@@ -0,0 +1,17 @@
+{
+  "reqId": "edge-cloudflare-access-REQ-002",
+  "prdId": "PRD-001",
+  "title": "An Access application is declared with an elicited hostname or self-hosted-app id and an elicited policy shape from the enum",
+  "description": "The blueprint elicits either an Access application hostname or a self-hosted-app id (one of the two) plus the JWT audience tag and JWKS URL, plus a policy shape from the enum (email-domain, service-token-only, service-token-plus-email-domain, group-membership). Applying the blueprint records the elicited values on rcf/blueprints/edge-cloudflare-access.applied.json; the shipped guide walks the operator through issuing the paired policy in the Cloudflare Zero Trust dashboard (screen-by-screen) and documents the alternative API path against api.cloudflare.com/client/v4/accounts/{account_id}/access/apps/{app_id}/policies.",
+  "category": "functional",
+  "domain": "edge",
+  "priority": "must",
+  "rationale": "Ratified in the Cloudflare round 6 spec (2026-09-06 section 5.4). Ships as v1.0.0 of edge-cloudflare-access.",
+  "tags": [
+    "blueprint:edge-cloudflare-access"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-07T16:00:00.000Z",
+  "updatedAt": "2026-09-07T16:00:00.000Z"
+}

package/blueprints/edge-cloudflare-access/contributions/requirements/edge-cloudflare-access-req-003.json

@@ -0,0 +1,17 @@
+{
+  "reqId": "edge-cloudflare-access-REQ-003",
+  "prdId": "PRD-001",
+  "title": "The operator issues a Zero Trust policy via the guide's dashboard walk-through or the alternative API path",
+  "description": "The shipped guide documents two paths for issuing the Zero Trust policy that the shipped validator enforces: (1) a screen-by-screen walk-through of the Cloudflare Zero Trust dashboard for the operator picking hostname-scoped or self-hosted applications, per https://developers.cloudflare.com/cloudflare-one/policies/access/; and (2) a curl example against https://api.cloudflare.com/client/v4/accounts/{account_id}/access/apps/{app_id}/policies for the operator preferring API automation. The API path is idempotent per Cloudflare's documented semantics; the dashboard path is not.",
+  "category": "functional",
+  "domain": "edge",
+  "priority": "must",
+  "rationale": "Ratified in the Cloudflare round 6 spec (2026-09-06 section 5.4). Ships as v1.0.0 of edge-cloudflare-access.",
+  "tags": [
+    "blueprint:edge-cloudflare-access"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-07T16:00:00.000Z",
+  "updatedAt": "2026-09-07T16:00:00.000Z"
+}

package/blueprints/edge-cloudflare-access/contributions/requirements/edge-cloudflare-access-req-004.json

@@ -0,0 +1,17 @@
+{
+  "reqId": "edge-cloudflare-access-REQ-004",
+  "prdId": "PRD-001",
+  "title": "The audit event carries only metadata fields (email, outcome, timestamp, path) with no token value and no header names beyond path",
+  "description": "Every validate-pass, validate-reject and bypass emits exactly one audit event on the injected sink with the metadata-only shape {email, outcome, timestamp, path}. The record is Object.frozen at the validator boundary so no downstream module can enrich it with a stray token slice or header value. The serialised JSON of every record contains no substring of the JWT (header, payload or signature), no Authorization value, and no header names beyond path.",
+  "category": "functional",
+  "domain": "edge",
+  "priority": "must",
+  "rationale": "Ratified in the Cloudflare round 6 spec (2026-09-06 section 5.4). Ships as v1.0.0 of edge-cloudflare-access.",
+  "tags": [
+    "blueprint:edge-cloudflare-access"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-07T16:00:00.000Z",
+  "updatedAt": "2026-09-07T16:00:00.000Z"
+}

package/blueprints/edge-cloudflare-access/contributions/requirements/edge-cloudflare-access-req-005.json

@@ -0,0 +1,17 @@
+{
+  "reqId": "edge-cloudflare-access-REQ-005",
+  "prdId": "PRD-001",
+  "title": "Break-glass posture: an elicited bypass-service-auth token pair authenticates CI automation with a distinct audit outcome",
+  "description": "The operator elicits a break-glass service-auth id (blueprint.json elicit access-bypass-service-auth-id) and a paired secret delegated to the applied security-secrets-management vault seam. When a request presents CF-Access-Client-Id and CF-Access-Client-Secret matching the elicited pair (or SIMULATE_BYPASS_SERVICE_AUTH forces the code path), the validator observes the pair, records outcome=bypass with the same metadata-only shape, and delegates to the handler with request.auth.email='service:'+id. Without an elicited pair the break-glass code path is disabled.",
+  "category": "functional",
+  "domain": "edge",
+  "priority": "must",
+  "rationale": "Ratified in the Cloudflare round 6 spec (2026-09-06 section 5.4). Ships as v1.0.0 of edge-cloudflare-access.",
+  "tags": [
+    "blueprint:edge-cloudflare-access"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-07T16:00:00.000Z",
+  "updatedAt": "2026-09-07T16:00:00.000Z"
+}

package/blueprints/edge-cloudflare-access/contributions/requirements/edge-cloudflare-access-req-006.json

@@ -0,0 +1,18 @@
+{
+  "reqId": "edge-cloudflare-access-REQ-006",
+  "prdId": "PRD-001",
+  "title": "Composition with application-admin-console v1.1.0: the sign-in surface flips per applied capability set",
+  "description": "When application-admin-console v1.1.0 is applied alongside edge-cloudflare-access, the admin-console reads the appliedCapabilities set at apply-time (via the shipped readAppliedCapabilities helper, the T-5 visual-round mechanism); with zeroTrustGate in the set the admin-console renders the Access-gated sign-in surface (data-surface=access-gated, no [data-surface=local-login], a [data-role=principal-read] with the request.auth email); without zeroTrustGate the admin-console falls back to whatever security-auth-* is applied (data-surface=local-login). The composition is deterministic; the pack check AC-21815-1 on the shipped application-admin-console.pack.mjs enforces the gated branch.",
+  "category": "functional",
+  "domain": "edge",
+  "priority": "must",
+  "rationale": "Ratified in the Cloudflare round 6 spec (2026-09-06 section 5.4 plus section 5.4.1 admin-console v1.1.0 delta; spec section 1 ruling 7). Ships as v1.0.0 of edge-cloudflare-access and v1.1.0 of application-admin-console in the same PR (round-4 T-4 capability-minor pattern).",
+  "tags": [
+    "blueprint:edge-cloudflare-access",
+    "blueprint:application-admin-console"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-07T16:00:00.000Z",
+  "updatedAt": "2026-09-07T16:00:00.000Z"
+}

package/blueprints/edge-cloudflare-access/contributions/tacs/tac-3501-edge-cloudflare-access-jwt-validator.json

@@ -0,0 +1,31 @@
+{
+  "tacId": "TAC-3501-edge-cloudflare-access-jwt-validator",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "name": "Access JWT validator with JWKS fetch and cache",
+  "purpose": "The single project-side module realising the Access JWT validator middleware. It is the sole reader of the Cf-Access-Jwt-Assertion header per REQ-001. Fetches the JWKS from env.ACCESS_JWKS_URL, caches keys per-kid for the elicited cache window, verifies the JWT against the cached key matching the header's kid, reduces the principal into request.auth as {email, sub, groups} and returns 401 on any validate-failure with a metadata-only audit event on the injected sink. Consumers never touch the header outside this module; the middleware is the one place the vendor surface lives so a future adapter (Google Cloud IAP, Duo Access) slots in without a consumer re-shape.",
+  "responsibilities": [
+    "Export createAccessValidator({env, eventSink, fetch, clock, bypassServiceAuth}) returning {validate, middleware} matching the Cloudflare Access JWT validation shape (AC-34101-1, AC-34102-1).",
+    "Own the ONLY reference to the Cf-Access-Jwt-Assertion header string in the applied source tree (AC-34103-1).",
+    "Emit exactly one audit event per validate outcome on the injected sink with the metadata-only shape {email, outcome, timestamp, path} (AC-34106-1).",
+    "Recognise the CF-Access-Client-Id / CF-Access-Client-Secret paired headers as break-glass when the elicited bypass-service-auth pair is applied, and route through with outcome=bypass (AC-34107-1)."
+  ],
+  "internalStructure": "One module (src/jwt-validator.mjs) exporting createAccessValidator. The middleware wires a fetch-shaped JWKS fetcher, a per-kid Map cache with a 60-second TTL and an audit sink boundary. The audit record is Object.frozen at the boundary so a downstream handler cannot enrich it with a stray token slice.",
+  "interfaces": [
+    {
+      "name": "createAccessValidator",
+      "kind": "factory",
+      "summary": "Access JWT validator factory over env.ACCESS_JWKS_URL and env.ACCESS_AUDIENCE."
+    },
+    {
+      "name": "validator.middleware",
+      "kind": "method",
+      "summary": "Handler-shaped middleware that either returns a rejection Response or attaches request.auth and returns rejected:false."
+    }
+  ],
+  "dependencies": [],
+  "createdAt": "2026-09-07T16:00:00.000Z",
+  "updatedAt": "2026-09-07T16:00:00.000Z"
+}

package/blueprints/edge-cloudflare-access/contributions/tacs/tac-3502-edge-cloudflare-access-application-declaration.json

@@ -0,0 +1,33 @@
+{
+  "tacId": "TAC-3502-edge-cloudflare-access-application-declaration",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "name": "Access application declaration surface",
+  "purpose": "The apply-time surface that captures the operator's Access application declaration: hostname or self-hosted-app id, JWT audience, JWKS URL, policy shape and (optionally) the break-glass service-auth pair. The declaration lands verbatim on rcf/blueprints/edge-cloudflare-access.applied.json so the shipped guide's dashboard walk-through and API alternative both operate on the same values.",
+  "responsibilities": [
+    "Elicit access-application-host OR access-selfhosted-app-id (exactly one is required at apply).",
+    "Elicit access-audience, access-jwks-url and access-policy-shape (from the enum in TAC-3503).",
+    "Elicit access-bypass-service-auth-id (blank disables break-glass); delegate the paired secret to the applied security-secrets-management vault seam.",
+    "Persist the elicited values on the applied-sidecar for the guide walk-through, the composition read from admin-console v1.1.0 and the sole-reader-scan probe."
+  ],
+  "internalStructure": "Declarative: the blueprint.json elicits[] block plus the applied-sidecar. The blueprint declares no runtime code path for the declaration surface itself; every consumer of the declaration reads the applied-sidecar via the shared readAppliedCapabilities helper.",
+  "interfaces": [
+    {
+      "name": "rcf/blueprints/edge-cloudflare-access.applied.json",
+      "kind": "artifact",
+      "summary": "The apply-time sidecar carrying the elicited declaration."
+    }
+  ],
+  "dependencies": [
+    {
+      "name": "TAC-3503 policy shape enum",
+      "kind": "tac",
+      "tacId": "TAC-3503-edge-cloudflare-access-policy-shape",
+      "description": "The policy-shape elicitation resolves to one of the enum values named in TAC-3503."
+    }
+  ],
+  "createdAt": "2026-09-07T16:00:00.000Z",
+  "updatedAt": "2026-09-07T16:00:00.000Z"
+}

package/blueprints/edge-cloudflare-access/contributions/tacs/tac-3503-edge-cloudflare-access-policy-shape.json

@@ -0,0 +1,25 @@
+{
+  "tacId": "TAC-3503-edge-cloudflare-access-policy-shape",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "name": "Access policy shape enum and its issuance flow",
+  "purpose": "Names the four policy shapes the blueprint supports: email-domain, service-token-only, service-token-plus-email-domain and group-membership. The guide walks each shape through the Cloudflare Zero Trust dashboard and documents the API alternative against api.cloudflare.com/client/v4/accounts/{account_id}/access/apps/{app_id}/policies per https://developers.cloudflare.com/cloudflare-one/policies/access/. A shape outside the enum is refused at apply.",
+  "responsibilities": [
+    "Enumerate the four shipped policy shapes.",
+    "Document the dashboard walk-through and the API alternative for each shape in the guide (AC-34105-1).",
+    "Name the audit outcome each shape emits on validate-pass (validated) and validate-reject (missing, expired, invalid)."
+  ],
+  "internalStructure": "Enum in blueprint.json elicits[]; the applied-sidecar records the operator's choice. The validator does not branch on the policy shape at runtime (the Cloudflare edge enforces the policy); the shape drives the guide's operator flow and the applied-sidecar seam the composition reads.",
+  "interfaces": [
+    {
+      "name": "access-policy-shape elicit",
+      "kind": "enum",
+      "summary": "email-domain | service-token-only | service-token-plus-email-domain | group-membership."
+    }
+  ],
+  "dependencies": [],
+  "createdAt": "2026-09-07T16:00:00.000Z",
+  "updatedAt": "2026-09-07T16:00:00.000Z"
+}

package/blueprints/edge-cloudflare-access/contributions/tacs/tac-3504-edge-cloudflare-access-audit-sink.json

@@ -0,0 +1,25 @@
+{
+  "tacId": "TAC-3504-edge-cloudflare-access-audit-sink",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "name": "Access audit sink with metadata-only shape",
+  "purpose": "Names the audit-event contract every validator outcome writes through the injected sink. The record shape is exactly {email, outcome, timestamp, path}; the sink boundary Object.freezes the record so a downstream handler cannot enrich it with a stray token slice. Retention and long-term storage are delegated to the applied logging companion per ADR-3504.",
+  "responsibilities": [
+    "Emit exactly one audit event per validate outcome on the injected sink (AC-34106-1).",
+    "Freeze the record at the boundary so no downstream handler can add a token substring or header value (AC-34106-1).",
+    "Support four outcomes: validated (pass), missing, expired, invalid (reject) and bypass (break-glass)."
+  ],
+  "internalStructure": "One helper (auditRecord) inside src/jwt-validator.mjs constructing the frozen four-key record. The sink itself is a caller-supplied function; a production consumer wires this to the applied logging companion (whose retention policy binds).",
+  "interfaces": [
+    {
+      "name": "eventSink",
+      "kind": "callback",
+      "summary": "A function accepting one audit record per validator outcome."
+    }
+  ],
+  "dependencies": [],
+  "createdAt": "2026-09-07T16:00:00.000Z",
+  "updatedAt": "2026-09-07T16:00:00.000Z"
+}