rcf-lite 0.23.0 → 0.24.0

package/CHANGELOG.md

@@ -6,6 +6,24 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 ## [Unreleased]
 
+## [0.24.0] - 2026-09-08
+
+rcf-lite 0.24.0 opens the Cloudflare line with six blueprints in one round: a Workers KV facade, cron triggers with an expression-router, durable objects covering strong-consistency and hibernatable WebSocket shapes, a Zero-Trust Access gate the admin console consumes, Turnstile with the pinned test keys running under a Playwright pack, and edge rate limiting with a committed manifest. Each blueprint verifies against the real Cloudflare engine through node-only probes, and the admin console reads the Access-gate capability to switch its sign-in surface.
+
+### Added
+
+- **Round 6 T-1: `platform-cloudflare-kv` v1.0.0 on the shelf (PR #166).** Workers KV facade as the sole reader of the KV namespace binding, a cache-aside helper, put, get, list-with-prefix, TTL, and metadata-only lifecycle events (`facadeReady`, `kvHit`, `kvMiss`, `kvWrite`). Probes drive miniflare inside the shared `packages/rcf-lite/test/fixtures/cf-platform/` fixture, plus one accountBound-skipped real-account eventual-consistency smoke. Declares `capabilities: ["keyValueStore"]`. Mints the new global topic `keyValueStoreContract`.
+- **Round 6 T-2: `platform-cloudflare-cron-triggers` v1.0.0 on the shelf (PR #167).** `scheduled()` handler contract with an expression-router, a skew-tolerance discipline, and metadata-only lifecycle events (`cronReady`, `cronFired`, `cronSkewed`, `cronStalled`, `cronUnmatched`). Probes drive `wrangler dev --test-scheduled` against the shared `cf-platform` fixture, plus one accountBound-skipped real-account scheduled smoke. Composes with `jobs-background` when the applied scheduler mode is `workerCron`. Declares `capabilities: ["scheduledTrigger"]`. Mints the new global topic `scheduledTriggerContract`.
+- **Round 6 T-3: `platform-cloudflare-durable-objects` v1.0.0 on the shelf (PR #168).** Two shapes in one blueprint, strong-consistency single-cell and hibernatable WebSocket hub, alongside a sole-reader AST scan on the DO namespace binding, a storage round-trip, an alarm-fires-once check, and a hub-broadcast check. Probes drive `wrangler dev` on workerd against the shared `cf-platform` fixture (runtime-guarantee-through-the-real-engine per the round-6 gate lesson), plus one accountBound-skipped real-account storage-backend smoke. Declares `capabilities: ["strongConsistencyCell", "hibernatableWebSocket"]`. Mints the new global topics `strongConsistencyCellContract` and `websocketHubContract`.
+- **Round 6 T-4: `edge-cloudflare-access` v1.0.0 on the shelf, with `application-admin-console` 1.1.0 folded into the same PR (PR #169).** JWT validator as the sole reader of the `Cf-Access-Jwt-Assertion` header, an Access application shape, an audit-event record with metadata-only secrecy, and a real-account gated-URL probe that runs accountBound-skipped without a Cloudflare account. Declares `capabilities: ["zeroTrustGate"]`. Mints the new global topic `edgeAuthenticationGate`. In the same PR, `application-admin-console` bumps to 1.1.0 declaring consumption of `zeroTrustGate`: when Access is applied, the admin console reads the applied-sidecar and switches its sign-in surface to the Access-gated shape (no local login form; principal reduction reads from `request.auth`). Absent `zeroTrustGate`, the admin console falls back to the v1.0.0 behaviour.
+- **Round 6 T-5: `edge-cloudflare-turnstile` v1.0.0 on the shelf (PR #170).** Client widget mount pinned to the Cloudflare Turnstile host only, server-side siteverify against `https://challenges.cloudflare.com/turnstile/v0/siteverify`, a refuse-if-token-missing guard, and a magic-link mint-surface hook. Node probes drive the fixture, and a Playwright pack runs four checks against Cloudflare live siteverify using the pinned test sitekeys `1x00000000000000000000AA` (always-pass), `2x00000000000000000000AB` (always-fail) and `3x00000000000000000000FF` (forced-interactive) with their paired secrets. Declares `capabilities: ["humanCheck"]`. Mints the new global topic `humanVerificationGate`. First `uiBearing: true` FBS on the shelf.
+- **Round 6 T-6: `edge-cloudflare-rate-limiting` v1.0.0 on the shelf (PR #171).** Local manifest under `cloudflare/rate-limits/*.json`, manifest presence and schema validation, a drift-audit shape against the applied Cloudflare account, and metadata-only rate-limit events. One accountBound-skipped real-account burst-and-429 probe. Declares `capabilities: ["edgeRateLimit"]`. Mints the new global topic `edgeThrottleContract`.
+- **Authoring standard capability table extended.** `packages/rcf-lite/docs/blueprint-authoring.md` section 6a gains seven new rows: `keyValueStore`, `scheduledTrigger`, `strongConsistencyCell`, `hibernatableWebSocket`, `zeroTrustGate`, `humanCheck`, `edgeRateLimit`. Chunk-zero-style append, loader unchanged.
+
+### Changed
+
+- **`application-admin-console` v1.0.0 to v1.1.0 (PR #169).** Declares optional consumption of `zeroTrustGate` and switches sign-in surface accordingly. No new elicit; `principalDirectory` remains the sole hard requirement.
+
 ## [0.23.0] - 2026-09-07
 
 rcf-lite 0.23.0 adds the infrastructure spine four blueprints wide: a Postgres store with a facade contract and forward-only migrations, an S3-shape object store with a Cloudflare R2 first adapter, a Cloudflare Queues producer and consumer with dead-letter semantics, and a background-jobs discipline that refuses to apply until a queue is applied. Each blueprint verifies against the real engine with node-only probes, and the four surfaces compose through the capability mechanism the round-3 admin console shipped.

package/blueprints/application-account-settings/docs/topics.md

@@ -19,7 +19,7 @@ The blueprint claims no new global topics at v1.0.0. Account-settings is a consu
 | application-charts | 18101-18899 | 19xx | shipped v1.0.0 | none |
 | application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
 | application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
-| application-admin-console | 21101-21899 | 22xx | shipped v1.0.0 | none |
+| application-admin-console | 21101-21899 | 22xx | shipped v1.1.0 | `adminConsoleSignInSurface` |
 | application-empty-error-states | 22101-22899 | 23xx | shipped v1.0.0 | none |
 | application-file-upload | 23101-23899 | 24xx | shipped v1.0.0 | none |
 | application-forms-wizard | 24101-24899 | 25xx | shipped v1.0.0 | none |
@@ -29,6 +29,12 @@ The blueprint claims no new global topics at v1.0.0. Account-settings is a consu
 | object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
+| platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
+| platform-cloudflare-cron-triggers | 32101-32899 | 33xx | shipped v1.0.0 | `scheduledTriggerContract` |
+| platform-cloudflare-durable-objects | 33101-33899 | 34xx | shipped v1.0.0 | `strongConsistencyCellContract`, `websocketHubContract` |
+| edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
+| edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
+| edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
 
 The shelf-wide band registry lives in `packages/rcf-lite/docs/blueprint-authoring.md` section 5.
 

package/blueprints/application-admin-console/CHANGELOG.md

@@ -1,5 +1,17 @@
 # application-admin-console CHANGELOG
 
+## 1.1.0 (2026-09-07)
+
+### Added
+
+- Consume the `zeroTrustGate` capability optionally at apply-time via the shipped `readAppliedCapabilities()` helper (the T-5 visual-round mechanism). When `zeroTrustGate` is in the applied capability set, `/admin/sign-in` renders the Access-gated sign-in surface: `[data-surface=access-gated]` with no local login form, plus a `[data-role=principal-read]` element carrying the principal email read from `request.auth`. When `zeroTrustGate` is absent the surface falls back to the local `security-auth-*` surface with `[data-surface=local-login]` and the existing local form. Additive minor: `requiresAppliedCapabilities.capabilities[]` stays `["principalDirectory"]` (Q4 default per Cloudflare round 6 spec section 5.4.1: making Access-gate hard is a v2.0 change).
+- 6 new contributions on the admin-console shelf entry: 1 REQ (`application-admin-console-REQ-014`), 2 USs (`application-admin-console-US-21815` Access-gated sign-in, `application-admin-console-US-21816` fallback branch), 1 TAC (`TAC-2214-application-admin-console-access-gated-signin-surface`), 1 ADR (`ADR-2214-application-admin-console-consume-zero-trust-gate`, scope global on new topic `adminConsoleSignInSurface` with `standardsTraceClause: Cloudflare round 6 spec section 5.4 (admin-console v1.1.0 delta)` and `recommendedDefault: true`) and 1 pack check (`AC-21815-1`) on the existing `application-admin-console.pack.mjs`.
+- Sign-in route extension on the shipped `packages/rcf-lite/test/fixtures/probe-pack-application-admin-console/` fixture: a new `/admin/sign-in` route that renders the Access-gated or local-login surface based on the applied caps (`?caps=zeroTrustGate` picks the gated branch). The existing `?caps=` combinations are preserved; the `AC-21815-1` pack check exercises both branches.
+
+### Composition
+
+- Rides the T-4 PR alongside `edge-cloudflare-access` v1.0.0 (round-4 T-4 capability-minor pattern). The Access-gated surface reads `request.auth.email`, which the shipped `edge-cloudflare-access` JWT validator sets after JWKS verification.
+
 ## 1.0.0 (visual round T-5, spec 2026-09-04)
 
 - First ratified version of the shelf's admin-console blueprint. Six REQs (console shell with no dead links, conditional users, conditional roles with Owner + Admin + Member + Viewer baseline, conditional orgs, conditional audit-log, access-denied plus request-access), nine USs 21101-21109 binding 16 runtime-observable ACs, four TACs 2201-2204 (shell, capability discovery, permission matrix, audit view consuming datatable), four ADRs 2201-2204 (capability vocabulary, baseline roles, invite transport, audit retention). No new global topics.

package/blueprints/application-admin-console/blueprint.json

@@ -1,6 +1,6 @@
 {
   "slug": "application-admin-console",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "category": "application",
   "requiresAppliedCapabilities": {
     "capabilities": [
@@ -221,6 +221,39 @@
       "path": "adrs/adr-2204-application-admin-console-audit-retention.json",
       "elicited": true,
       "standardsTraceClause": "generic enterprise practice"
+    },
+    {
+      "id": "application-admin-console-REQ-014",
+      "kind": "req",
+      "path": "requirements/application-admin-console-req-014.json"
+    },
+    {
+      "id": "application-admin-console-US-21815",
+      "kind": "us",
+      "path": "user-stories/application-admin-console-us-21815.json"
+    },
+    {
+      "id": "application-admin-console-US-21816",
+      "kind": "us",
+      "path": "user-stories/application-admin-console-us-21816.json"
+    },
+    {
+      "id": "TAC-2214-application-admin-console-access-gated-signin-surface",
+      "kind": "tac",
+      "path": "tacs/tac-2214-application-admin-console-access-gated-signin-surface.json"
+    },
+    {
+      "id": "ADR-2214-application-admin-console-consume-zero-trust-gate",
+      "kind": "adr",
+      "path": "adrs/adr-2214-application-admin-console-consume-zero-trust-gate.json",
+      "scope": "global",
+      "topic": "adminConsoleSignInSurface",
+      "recommendedDefault": true,
+      "elicited": false,
+      "standardsTraceClause": "Cloudflare round 6 spec section 5.4 (admin-console v1.1.0 delta)"
     }
+  ],
+  "optionalCapabilities": [
+    "zeroTrustGate"
   ]
 }

package/blueprints/application-admin-console/contributions/adrs/adr-2214-application-admin-console-consume-zero-trust-gate.json

@@ -0,0 +1,25 @@
+{
+  "adrId": "ADR-2214-application-admin-console-consume-zero-trust-gate",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.1.0",
+  "status": "accepted",
+  "title": "Admin-console reads zeroTrustGate at apply-time and switches sign-in surface (scope global, adminConsoleSignInSurface)",
+  "context": "application-admin-console v1.0.0 shipped with principalDirectory as the sole hard requirement; the sign-in surface was local per whatever security-auth-* was applied. Round-6 T-4 introduces edge-cloudflare-access with the zeroTrustGate capability; a composed deployment needs the admin-console to flip its sign-in surface deterministically so the Access-gated deployment stops rendering the local login form.",
+  "decision": "application-admin-console v1.1.0 reads appliedCapabilities via readAppliedCapabilities at apply-time (the T-5 visual-round mechanism). When zeroTrustGate is present the sign-in surface renders access-gated (no local form, principal reads from request.auth); when absent the surface falls back to whatever security-auth-* is applied. Q4 default per spec 5.4.1: zeroTrustGate is CONSUMED OPTIONALLY; principalDirectory remains the sole hard requirement (making Access-gate hard is a v2.0 change). The adminConsoleSignInSurface topic scope is global on this blueprint at v1.1.0; the topic string is adminConsoleSignInSurface (camelCase, one concept per topic).",
+  "consequences": "The v1.1.0 admin-console remains backward-compatible with every v1.0.0 deployment. An Access-gated deployment automatically stops rendering the local login form (the shipped pack check AC-21815-1 catches a stray local-login region under zeroTrustGate). The fallback branch (local-login surface) ships in v1.1.0 unchanged; a v2.0.0 that makes Access-gate hard would remove the fallback branch (breaking-change). Standards trace clause: Cloudflare round 6 spec section 5.4 (admin-console v1.1.0 delta).",
+  "alternativesConsidered": [
+    {
+      "name": "Make zeroTrustGate a hard requirement on admin-console v1.1.0",
+      "summary": "Add zeroTrustGate to requiresAppliedCapabilities.capabilities[]; admin-console apply refuses without it.",
+      "reasonNotChosen": "Breaks every v1.0.0 deployment that never adopted Cloudflare Access; violates the additive-minor contract. Making Access-gate hard is a v2.0.0 change per the Q4 default in spec section 5.4.1."
+    },
+    {
+      "name": "Ship two admin-console blueprints (local-only and access-gated)",
+      "summary": "Split the surface across two slugs so the operator picks at apply.",
+      "reasonNotChosen": "Doubles the shelf surface area and duplicates every other contribution. The applied-capability read is the shipped mechanism for exactly this composition (T-5 visual-round)."
+    }
+  ],
+  "createdAt": "2026-09-07T16:00:00.000Z",
+  "updatedAt": "2026-09-07T16:00:00.000Z"
+}

package/blueprints/application-admin-console/contributions/requirements/application-admin-console-req-014.json

@@ -0,0 +1,17 @@
+{
+  "reqId": "application-admin-console-REQ-014",
+  "prdId": "PRD-001",
+  "title": "Consume zeroTrustGate optionally when applied alongside a zeroTrustGate provider",
+  "description": "application-admin-console v1.1.0 reads the appliedCapabilities set at apply-time via the shipped readAppliedCapabilities() helper (the T-5 visual-round mechanism). When zeroTrustGate is present alongside the sole hard requirement principalDirectory, the admin-console renders the Access-gated sign-in surface (no local login form; principal reads from request.auth via [data-role=principal-read]). When zeroTrustGate is absent the admin-console falls back to the local security-auth-* sign-in surface unchanged from v1.0.0. Q4 default per spec section 5.4.1: consumption is OPTIONAL; requiresAppliedCapabilities.capabilities[] remains [principalDirectory] (making Access-gate hard is a v2.0 change).",
+  "category": "functional",
+  "domain": "application",
+  "priority": "must",
+  "rationale": "Ratified in the Cloudflare round 6 spec (2026-09-06 section 5.4.1) alongside edge-cloudflare-access v1.0.0. Round-4 T-4 capability-minor pattern: the admin-console minor rides the edge-cloudflare-access PR.",
+  "tags": [
+    "blueprint:application-admin-console"
+  ],
+  "version": "1.1.0",
+  "status": "approved",
+  "createdAt": "2026-09-07T16:00:00.000Z",
+  "updatedAt": "2026-09-07T16:00:00.000Z"
+}

package/blueprints/application-admin-console/contributions/tacs/tac-2214-application-admin-console-access-gated-signin-surface.json

@@ -0,0 +1,32 @@
+{
+  "tacId": "TAC-2214-application-admin-console-access-gated-signin-surface",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.1.0",
+  "status": "approved",
+  "name": "Access-gated sign-in surface with principal-read-from-request contract",
+  "purpose": "Names the sign-in surface shape the admin-console renders when zeroTrustGate is in the applied capability set. The Access-gated shape carries [data-surface=access-gated], no local form, and a [data-role=principal-read] element rendering the principal email read from request.auth. The fallback shape (zeroTrustGate absent) carries [data-surface=local-login] with the security-auth-* local login form. The two are mutually exclusive on any /admin/sign-in render.",
+  "responsibilities": [
+    "Render the Access-gated surface with [data-surface=access-gated] when zeroTrustGate is in appliedCapabilities (AC-21815-1).",
+    "Render the local-login surface with [data-surface=local-login] when zeroTrustGate is absent (AC-21816-1).",
+    "Read the principal email from request.auth and render it in [data-role=principal-read] on the gated branch.",
+    "Never render both surfaces on the same request; ensure the two are mutually exclusive per applied set."
+  ],
+  "internalStructure": "Applied-capability-driven surface pick in the sign-in route. The applied-sidecar (rcf/blueprints/application-admin-console.applied.json) records the appliedCapabilities set; the shipped readAppliedCapabilities() helper reads it at apply-time (T-5 visual-round mechanism). No new elicits on the admin-console side: the sign-in seam is deterministic once the applied set is known.",
+  "interfaces": [
+    {
+      "name": "GET /admin/sign-in",
+      "kind": "route",
+      "summary": "Sign-in surface route the admin-console shell renders per applied-capability set."
+    }
+  ],
+  "dependencies": [
+    {
+      "name": "T-4 edge-cloudflare-access v1.0.0 (zeroTrustGate provider)",
+      "kind": "blueprint",
+      "description": "Applied alongside admin-console v1.1.0 to compose the Access-gated sign-in surface."
+    }
+  ],
+  "createdAt": "2026-09-07T16:00:00.000Z",
+  "updatedAt": "2026-09-07T16:00:00.000Z"
+}

package/blueprints/application-admin-console/contributions/user-stories/application-admin-console-us-21815.json

@@ -0,0 +1,27 @@
+{
+  "usId": "application-admin-console-US-21815",
+  "prdId": "PRD-001",
+  "reqId": "application-admin-console-REQ-014",
+  "version": "1.1.0",
+  "status": "approved",
+  "title": "Access-gated sign-in surface renders when zeroTrustGate is applied",
+  "asA": "shelf consumer applying application-admin-console v1.1.0 with zeroTrustGate in the applied capability set",
+  "iWant": "the sign-in surface to render as Access-gated with no local login form and to read the principal from request.auth",
+  "soThat": "the admin console composes with edge-cloudflare-access at the sign-in seam and never re-collects credentials in an Access-gated deployment",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-21815-1",
+      "description": "When application-admin-console v1.1.0 is applied with zeroTrustGate in appliedCapabilities, GET /admin/sign-in renders a region with [data-surface=access-gated], no [data-surface=local-login] region is present, and a [data-role=principal-read] element renders the principal email read from request.auth. The shipped pack check AC-21815-1 on application-admin-console.pack.mjs asserts all three (fires only when zeroTrustGate is in the applied set).",
+      "given": "the extended admin-console pack fixture on ?caps=principalDirectory,roleModel,auditLog,zeroTrustGate",
+      "when": "the pack drives GET /admin/sign-in",
+      "then": "the DOM carries [data-surface=access-gated], no [data-surface=local-login], and a [data-role=principal-read] with the request.auth email",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-2214-application-admin-console-access-gated-signin-surface"
+  ],
+  "createdAt": "2026-09-07T16:00:00.000Z",
+  "updatedAt": "2026-09-07T16:00:00.000Z"
+}

package/blueprints/application-admin-console/contributions/user-stories/application-admin-console-us-21816.json

@@ -0,0 +1,27 @@
+{
+  "usId": "application-admin-console-US-21816",
+  "prdId": "PRD-001",
+  "reqId": "application-admin-console-REQ-014",
+  "version": "1.1.0",
+  "status": "approved",
+  "title": "Falls back to security-auth-* local login when zeroTrustGate is absent",
+  "asA": "shelf consumer applying application-admin-console v1.1.0 WITHOUT zeroTrustGate in the applied capability set",
+  "iWant": "the sign-in surface to render as the local security-auth-* surface with no Access-gated region",
+  "soThat": "the v1.1.0 admin-console remains backward-compatible with every v1.0.0 deployment that never adopted Access",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-21816-1",
+      "description": "When application-admin-console v1.1.0 is applied without zeroTrustGate in appliedCapabilities, GET /admin/sign-in renders a region with [data-surface=local-login] and no [data-surface=access-gated] region is present. The local login form ships with data-role=local-login-form and data-action=local-sign-in controls.",
+      "given": "the extended admin-console pack fixture on ?caps=principalDirectory,roleModel,auditLog",
+      "when": "the pack drives GET /admin/sign-in",
+      "then": "the DOM carries [data-surface=local-login] and no [data-surface=access-gated]",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-2214-application-admin-console-access-gated-signin-surface"
+  ],
+  "createdAt": "2026-09-07T16:00:00.000Z",
+  "updatedAt": "2026-09-07T16:00:00.000Z"
+}

package/blueprints/application-admin-console/docs/topics.md

@@ -19,7 +19,7 @@ The blueprint claims no new global topics at v1.0.0. The console is a consumer o
 | application-charts | 18101-18899 | 19xx | shipped v1.0.0 | none |
 | application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
 | application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
-| application-admin-console | 21101-21899 | 22xx | shipped v1.0.0 | none |
+| application-admin-console | 21101-21899 | 22xx | shipped v1.1.0 | `adminConsoleSignInSurface` |
 | application-empty-error-states | 22101-22899 | 23xx | shipped v1.0.0 | none |
 | application-file-upload | 23101-23899 | 24xx | shipped v1.0.0 | none |
 | application-forms-wizard | 24101-24899 | 25xx | shipped v1.0.0 | none |
@@ -29,6 +29,12 @@ The blueprint claims no new global topics at v1.0.0. The console is a consumer o
 | object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
+| platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
+| platform-cloudflare-cron-triggers | 32101-32899 | 33xx | shipped v1.0.0 | `scheduledTriggerContract` |
+| platform-cloudflare-durable-objects | 33101-33899 | 34xx | shipped v1.0.0 | `strongConsistencyCellContract`, `websocketHubContract` |
+| edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
+| edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
+| edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
 
 The shelf-wide band registry lives in `packages/rcf-lite/docs/blueprint-authoring.md` section 5.
 

package/blueprints/application-admin-console/guide/application-admin-console.md

@@ -27,3 +27,27 @@ The blueprint's README lists the runtime-observable ACs the pack does NOT bind d
 - The role catalogue label vocabulary drifts across three or more applied auth blueprints: candidate for a `roleModel` global topic in a v1.1.0 minor.
 - The tenancy shape needs a real shelf provider: candidate for the `application-tenancy-orgs` blueprint (spec section 11).
 - A dedicated audit-log blueprint ships: candidate for the console to consume it directly via `capabilities: ["auditLog"]` rather than through the logging companion.
+
+## v1.1.0 minor: Access-gate consumption (Cloudflare round 6 T-4)
+
+Applying `edge-cloudflare-access` v1.0.0 alongside `application-admin-console` v1.1.0 flips the sign-in surface on `/admin/sign-in`. The admin-console reads `appliedCapabilities` at apply-time via the shipped `readAppliedCapabilities()` helper (the T-5 visual-round mechanism).
+
+- With `zeroTrustGate` in the applied set: the sign-in page renders `[data-surface=access-gated]` with no local login form. A `[data-role=principal-read]` element carries the principal email the `edge-cloudflare-access` JWT validator attached to `request.auth`. The shipped pack check `AC-21815-1` on `application-admin-console.pack.mjs` asserts the shape.
+- Without `zeroTrustGate`: the sign-in page renders `[data-surface=local-login]` with the local `security-auth-*` form unchanged from v1.0.0. Every v1.0.0 deployment continues to work; the minor is strictly additive.
+
+The Q4 default (spec section 5.4.1) is: consumption is OPTIONAL. `requiresAppliedCapabilities.capabilities[]` remains `["principalDirectory"]`; making Access-gate hard is a v2.0 change (the fallback branch would be removed).
+
+Composed apply-line, one project:
+
+```
+rcf define blueprint add application-admin-console --version 1.1.0
+rcf define blueprint add edge-cloudflare-access --version 1.0.0 --answer access-application-host=admin.example.com --answer access-audience=<audience> --answer access-jwks-url=https://<team>.cloudflareaccess.com/cdn-cgi/access/certs --answer access-policy-shape=email-domain
+```
+
+Fall-back apply-line (no Access; the v1.1.0 admin-console behaves identically to v1.0.0):
+
+```
+rcf define blueprint add application-admin-console --version 1.1.0
+```
+
+Standards trace clause for the ADR: `Cloudflare round 6 spec section 5.4 (admin-console v1.1.0 delta)`.

package/blueprints/application-admin-console/probe-packs/application-admin-console.pack.mjs

@@ -38,7 +38,7 @@ function withUrl(runtimeUrl, path) {
 
 export default {
   packName: 'application-admin-console',
-  version: '1.0.0',
+  version: '1.1.0',
   blueprintSlug: 'application-admin-console',
   // Applies to any FBS that realises the console shell TAC or whose
   // navModel routes name an admin path. Names both `tacIds` and `route`
@@ -178,5 +178,30 @@ export default {
         return { verdict: 'pass', detail: 'auditRows=' + dom.ids.length + ' columns=' + JSON.stringify(dom.firstRowColumns) };
       },
     },
+      {
+      id: 'AC-21815-1',
+      severity: 'block',
+      description: 'Access-gated sign-in surface renders when zeroTrustGate is applied: [data-surface=access-gated] present, [data-surface=local-login] absent, and [data-role=principal-read] carries the principal email read from request.auth (T-4 admin-console v1.1.0 delta, Cloudflare round 6 spec 5.4.1)',
+      appliesTo: async ({ projectRoot }) => {
+        const caps = await readAppliedCapabilities(projectRoot);
+        return caps.includes('zeroTrustGate');
+      },
+      run: async ({ browser, runtimeUrl }) => {
+        if (!browser) return { verdict: 'fail', detail: 'no packBrowser wired' };
+        await browser.goto(withUrl(runtimeUrl, '/admin/sign-in?caps=principalDirectory,roleModel,auditLog,zeroTrustGate'));
+        const dom = await browser.evaluate(() => {
+          const gated = document.querySelector('[data-surface="access-gated"]');
+          const local = document.querySelector('[data-surface="local-login"]');
+          const principalRead = document.querySelector('[data-role="principal-read"]');
+          const principalText = principalRead ? principalRead.textContent.trim() : null;
+          return { gatedPresent: !!gated, localPresent: !!local, principalReadPresent: !!principalRead, principalText };
+        });
+        if (!dom.gatedPresent) return { verdict: 'fail', detail: 'Access-gated sign-in surface missing: [data-surface="access-gated"] not found on /admin/sign-in under applied zeroTrustGate' };
+        if (dom.localPresent) return { verdict: 'fail', detail: 'Access-gated sign-in surface leak: [data-surface="local-login"] rendered alongside access-gated under applied zeroTrustGate' };
+        if (!dom.principalReadPresent) return { verdict: 'fail', detail: '[data-role="principal-read"] element missing on the Access-gated surface' };
+        if (!dom.principalText || dom.principalText.length === 0) return { verdict: 'fail', detail: '[data-role="principal-read"] element carries an empty principal (expected the email read from request.auth)' };
+        return { verdict: 'pass', detail: 'Access-gated surface renders: gatedPresent=true localPresent=false principalRead="' + dom.principalText + '"' };
+      },
+    },
   ],
 };

package/blueprints/application-api-rest/docs/topics.md

@@ -42,7 +42,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | application-charts | 18101-18899 | 19xx | shipped v1.0.0 | none |
 | application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
 | application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
-| application-admin-console | 21101-21899 | 22xx | shipped v1.0.0 | none |
+| application-admin-console | 21101-21899 | 22xx | shipped v1.1.0 | `adminConsoleSignInSurface` |
 | application-empty-error-states | 22101-22899 | 23xx | shipped v1.0.0 | none |
 | application-file-upload | 23101-23899 | 24xx | shipped v1.0.0 | none |
 | application-forms-wizard | 24101-24899 | 25xx | shipped v1.0.0 | none |
@@ -52,6 +52,12 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
+| platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
+| platform-cloudflare-cron-triggers | 32101-32899 | 33xx | shipped v1.0.0 | `scheduledTriggerContract` |
+| platform-cloudflare-durable-objects | 33101-33899 | 34xx | shipped v1.0.0 | `strongConsistencyCellContract`, `websocketHubContract` |
+| edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
+| edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
+| edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
 
 Suffix-family ids (ADR, TAC): SPA numbers in the 2xx range, this package takes 3xx (ADR-301 to ADR-308, TAC-301 to TAC-306); the next blueprint should take 4xx.
 

package/blueprints/application-charts/docs/topics.md

@@ -18,7 +18,7 @@ The blueprint claims no new global topics at v1.0.0. The chart-component contrac
 | application-charts | 18101-18899 | 19xx | shipped v1.0.0 | none |
 | application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
 | application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
-| application-admin-console | 21101-21899 | 22xx | shipped v1.0.0 | none |
+| application-admin-console | 21101-21899 | 22xx | shipped v1.1.0 | `adminConsoleSignInSurface` |
 | application-empty-error-states | 22101-22899 | 23xx | shipped v1.0.0 | none |
 | application-file-upload | 23101-23899 | 24xx | shipped v1.0.0 | none |
 | application-forms-wizard | 24101-24899 | 25xx | shipped v1.0.0 | none |
@@ -28,6 +28,12 @@ The blueprint claims no new global topics at v1.0.0. The chart-component contrac
 | object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
+| platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
+| platform-cloudflare-cron-triggers | 32101-32899 | 33xx | shipped v1.0.0 | `scheduledTriggerContract` |
+| platform-cloudflare-durable-objects | 33101-33899 | 34xx | shipped v1.0.0 | `strongConsistencyCellContract`, `websocketHubContract` |
+| edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
+| edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
+| edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
 
 The shelf-wide band registry lives in `packages/rcf-lite/docs/blueprint-authoring.md` section 5.
 

package/blueprints/application-dashboard/docs/topics.md

@@ -18,7 +18,7 @@ The blueprint claims no new global topics at v1.0.0. The dashboard-shell contrac
 | application-charts | 18101-18899 | 19xx | shipped v1.0.0 | none |
 | application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
 | application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
-| application-admin-console | 21101-21899 | 22xx | shipped v1.0.0 | none |
+| application-admin-console | 21101-21899 | 22xx | shipped v1.1.0 | `adminConsoleSignInSurface` |
 | application-empty-error-states | 22101-22899 | 23xx | shipped v1.0.0 | none |
 | application-file-upload | 23101-23899 | 24xx | shipped v1.0.0 | none |
 | application-forms-wizard | 24101-24899 | 25xx | shipped v1.0.0 | none |
@@ -28,6 +28,12 @@ The blueprint claims no new global topics at v1.0.0. The dashboard-shell contrac
 | object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
+| platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
+| platform-cloudflare-cron-triggers | 32101-32899 | 33xx | shipped v1.0.0 | `scheduledTriggerContract` |
+| platform-cloudflare-durable-objects | 33101-33899 | 34xx | shipped v1.0.0 | `strongConsistencyCellContract`, `websocketHubContract` |
+| edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
+| edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
+| edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
 
 The shelf-wide band registry lives in `packages/rcf-lite/docs/blueprint-authoring.md` section 5.
 

package/blueprints/application-datatable/docs/topics.md

@@ -17,7 +17,7 @@ The blueprint claims no new global topics at v1.0.0. The datatable shell is a ge
 | application-charts | 18101-18899 | 19xx | shipped v1.0.0 | none |
 | application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
 | application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
-| application-admin-console | 21101-21899 | 22xx | shipped v1.0.0 | none |
+| application-admin-console | 21101-21899 | 22xx | shipped v1.1.0 | `adminConsoleSignInSurface` |
 | application-empty-error-states | 22101-22899 | 23xx | shipped v1.0.0 | none |
 | application-file-upload | 23101-23899 | 24xx | shipped v1.0.0 | none |
 | application-forms-wizard | 24101-24899 | 25xx | shipped v1.0.0 | none |
@@ -27,6 +27,12 @@ The blueprint claims no new global topics at v1.0.0. The datatable shell is a ge
 | object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
+| platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
+| platform-cloudflare-cron-triggers | 32101-32899 | 33xx | shipped v1.0.0 | `scheduledTriggerContract` |
+| platform-cloudflare-durable-objects | 33101-33899 | 34xx | shipped v1.0.0 | `strongConsistencyCellContract`, `websocketHubContract` |
+| edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
+| edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
+| edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
 
 The shelf-wide band registry lives in `packages/rcf-lite/docs/blueprint-authoring.md` section 5.
 

package/blueprints/application-empty-error-states/docs/topics.md

@@ -18,7 +18,7 @@ The blueprint claims no new global topics at v1.0.0. Every ADR (HTTP status cont
 | application-charts | 18101-18899 | 19xx | shipped v1.0.0 | none |
 | application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
 | application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
-| application-admin-console | 21101-21899 | 22xx | shipped v1.0.0 | none |
+| application-admin-console | 21101-21899 | 22xx | shipped v1.1.0 | `adminConsoleSignInSurface` |
 | application-empty-error-states | 22101-22899 | 23xx | shipped v1.0.0 | none |
 | application-file-upload | 23101-23899 | 24xx | shipped v1.0.0 | none |
 | application-forms-wizard | 24101-24899 | 25xx | shipped v1.0.0 | none |
@@ -28,6 +28,12 @@ The blueprint claims no new global topics at v1.0.0. Every ADR (HTTP status cont
 | object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
+| platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
+| platform-cloudflare-cron-triggers | 32101-32899 | 33xx | shipped v1.0.0 | `scheduledTriggerContract` |
+| platform-cloudflare-durable-objects | 33101-33899 | 34xx | shipped v1.0.0 | `strongConsistencyCellContract`, `websocketHubContract` |
+| edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
+| edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
+| edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
 
 The shelf-wide band registry lives in `packages/rcf-lite/docs/blueprint-authoring.md` section 5.
 

package/blueprints/application-error-handling/docs/topics.md

@@ -24,7 +24,7 @@
 | application-charts | 18101-18899 | 19xx | shipped v1.0.0 | none |
 | application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
 | application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
-| application-admin-console | 21101-21899 | 22xx | shipped v1.0.0 | none |
+| application-admin-console | 21101-21899 | 22xx | shipped v1.1.0 | `adminConsoleSignInSurface` |
 | application-empty-error-states | 22101-22899 | 23xx | shipped v1.0.0 | none |
 | application-file-upload | 23101-23899 | 24xx | shipped v1.0.0 | none |
 | application-forms-wizard | 24101-24899 | 25xx | shipped v1.0.0 | none |
@@ -34,5 +34,11 @@
 | object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
+| platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
+| platform-cloudflare-cron-triggers | 32101-32899 | 33xx | shipped v1.0.0 | `scheduledTriggerContract` |
+| platform-cloudflare-durable-objects | 33101-33899 | 34xx | shipped v1.0.0 | `strongConsistencyCellContract`, `websocketHubContract` |
+| edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
+| edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
+| edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
 
 The shelf-wide band registry lives in `packages/rcf-lite/docs/blueprint-authoring.md` section 5.

package/blueprints/application-file-upload/docs/topics.md

@@ -19,7 +19,7 @@ The blueprint claims no new global topics at v1.0.0. Every ADR (transport branch
 | application-charts | 18101-18899 | 19xx | shipped v1.0.0 | none |
 | application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
 | application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
-| application-admin-console | 21101-21899 | 22xx | shipped v1.0.0 | none |
+| application-admin-console | 21101-21899 | 22xx | shipped v1.1.0 | `adminConsoleSignInSurface` |
 | application-empty-error-states | 22101-22899 | 23xx | shipped v1.0.0 | none |
 | application-file-upload | 23101-23899 | 24xx | shipped v1.0.0 | none |
 | application-forms-wizard | 24101-24899 | 25xx | shipped v1.0.0 | none |
@@ -29,6 +29,12 @@ The blueprint claims no new global topics at v1.0.0. Every ADR (transport branch
 | object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
+| platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
+| platform-cloudflare-cron-triggers | 32101-32899 | 33xx | shipped v1.0.0 | `scheduledTriggerContract` |
+| platform-cloudflare-durable-objects | 33101-33899 | 34xx | shipped v1.0.0 | `strongConsistencyCellContract`, `websocketHubContract` |
+| edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
+| edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
+| edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
 
 The shelf-wide band registry lives in `packages/rcf-lite/docs/blueprint-authoring.md` section 5.
 

package/blueprints/application-forms-wizard/docs/topics.md

@@ -18,7 +18,7 @@ The blueprint claims no new global topics at v1.0.0. Every ADR (navigation postu
 | application-charts | 18101-18899 | 19xx | shipped v1.0.0 | none |
 | application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
 | application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
-| application-admin-console | 21101-21899 | 22xx | shipped v1.0.0 | none |
+| application-admin-console | 21101-21899 | 22xx | shipped v1.1.0 | `adminConsoleSignInSurface` |
 | application-empty-error-states | 22101-22899 | 23xx | shipped v1.0.0 | none |
 | application-file-upload | 23101-23899 | 24xx | shipped v1.0.0 | none |
 | application-forms-wizard | 24101-24899 | 25xx | shipped v1.0.0 | none |
@@ -28,6 +28,12 @@ The blueprint claims no new global topics at v1.0.0. Every ADR (navigation postu
 | object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorage` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
+| platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
+| platform-cloudflare-cron-triggers | 32101-32899 | 33xx | shipped v1.0.0 | `scheduledTriggerContract` |
+| platform-cloudflare-durable-objects | 33101-33899 | 34xx | shipped v1.0.0 | `strongConsistencyCellContract`, `websocketHubContract` |
+| edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
+| edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
+| edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
 
 The shelf-wide band registry lives in `packages/rcf-lite/docs/blueprint-authoring.md` section 5.
 

package/blueprints/application-notifications-in-app/docs/topics.md

@@ -21,7 +21,7 @@ The `application-notifications-` prefix is reserved for the sibling channel blue
 | application-charts | 18101-18899 | 19xx | shipped v1.0.0 | none |
 | application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
 | application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
-| application-admin-console | 21101-21899 | 22xx | shipped v1.0.0 | none |
+| application-admin-console | 21101-21899 | 22xx | shipped v1.1.0 | `adminConsoleSignInSurface` |
 | application-empty-error-states | 22101-22899 | 23xx | shipped v1.0.0 | none |
 | application-file-upload | 23101-23899 | 24xx | shipped v1.0.0 | none |
 | application-forms-wizard | 24101-24899 | 25xx | shipped v1.0.0 | none |
@@ -31,6 +31,12 @@ The `application-notifications-` prefix is reserved for the sibling channel blue
 | object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
+| platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
+| platform-cloudflare-cron-triggers | 32101-32899 | 33xx | shipped v1.0.0 | `scheduledTriggerContract` |
+| platform-cloudflare-durable-objects | 33101-33899 | 34xx | shipped v1.0.0 | `strongConsistencyCellContract`, `websocketHubContract` |
+| edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
+| edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
+| edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
 | application-notifications-email (reserved) | to be claimed at ship | to be claimed at ship | name-only doc reservation (not shipped) | tba |
 | application-notifications-push (reserved) | to be claimed at ship | to be claimed at ship | name-only doc reservation (not shipped) | tba |
 | application-notifications-webhook (reserved) | to be claimed at ship | to be claimed at ship | name-only doc reservation (not shipped) | tba |

package/blueprints/application-onboarding-tour/docs/topics.md

@@ -17,7 +17,7 @@ The blueprint claims no new global topics at v1.0.0. Onboarding-tour is a consum
 | application-charts | 18101-18899 | 19xx | shipped v1.0.0 | none |
 | application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
 | application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
-| application-admin-console | 21101-21899 | 22xx | shipped v1.0.0 | none |
+| application-admin-console | 21101-21899 | 22xx | shipped v1.1.0 | `adminConsoleSignInSurface` |
 | application-empty-error-states | 22101-22899 | 23xx | shipped v1.0.0 | none |
 | application-file-upload | 23101-23899 | 24xx | shipped v1.0.0 | none |
 | application-forms-wizard | 24101-24899 | 25xx | shipped v1.0.0 | none |
@@ -27,6 +27,12 @@ The blueprint claims no new global topics at v1.0.0. Onboarding-tour is a consum
 | object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
+| platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
+| platform-cloudflare-cron-triggers | 32101-32899 | 33xx | shipped v1.0.0 | `scheduledTriggerContract` |
+| platform-cloudflare-durable-objects | 33101-33899 | 34xx | shipped v1.0.0 | `strongConsistencyCellContract`, `websocketHubContract` |
+| edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
+| edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
+| edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
 
 The shelf-wide band registry lives in `packages/rcf-lite/docs/blueprint-authoring.md` section 5.
 

package/blueprints/application-spa/docs/topics.md

@@ -47,7 +47,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | application-charts | 18101-18899 | 19xx | shipped v1.0.0 | none |
 | application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
 | application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
-| application-admin-console | 21101-21899 | 22xx | shipped v1.0.0 | none |
+| application-admin-console | 21101-21899 | 22xx | shipped v1.1.0 | `adminConsoleSignInSurface` |
 | application-empty-error-states | 22101-22899 | 23xx | shipped v1.0.0 | none |
 | application-file-upload | 23101-23899 | 24xx | shipped v1.0.0 | none |
 | application-forms-wizard | 24101-24899 | 25xx | shipped v1.0.0 | none |
@@ -57,6 +57,12 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
+| platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
+| platform-cloudflare-cron-triggers | 32101-32899 | 33xx | shipped v1.0.0 | `scheduledTriggerContract` |
+| platform-cloudflare-durable-objects | 33101-33899 | 34xx | shipped v1.0.0 | `strongConsistencyCellContract`, `websocketHubContract` |
+| edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
+| edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
+| edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
 
 SPA v1.1.0 stays on the LOW end of its band: v1.0.0 occupied US-1101 through US-1128; v1.1.0 adds US-1129 and US-1130, leaving headroom above 1130 for future minor bumps and for project-side stories that mechanically derive to the 11xx numeric range.