rcf-lite 0.23.0 → 0.24.0

package/blueprints/edge-cloudflare-turnstile/contributions/requirements/edge-cloudflare-turnstile-req-003.json

@@ -0,0 +1,17 @@
+{
+  "reqId": "edge-cloudflare-turnstile-REQ-003",
+  "prdId": "PRD-001",
+  "title": "Refuse-if-token-missing guard on elicited surfaces: a submit without a token is rejected with 400 before any downstream logic",
+  "description": "The applying project registers a token-required guard at every elicited surface. A submit whose payload lacks the Cf-Turnstile-Response field is rejected with 400 before any downstream handler runs. The refusal body carries a stable error-code (turnstile.token-missing), not the sitekey.",
+  "category": "functional",
+  "domain": "edge",
+  "priority": "must",
+  "rationale": "Ratified in the Cloudflare round 6 spec (2026-09-06 section 5.5). Ships as v1.0.0 of edge-cloudflare-turnstile.",
+  "tags": [
+    "blueprint:edge-cloudflare-turnstile"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-07T20:00:00.000Z",
+  "updatedAt": "2026-09-07T20:00:00.000Z"
+}

package/blueprints/edge-cloudflare-turnstile/contributions/requirements/edge-cloudflare-turnstile-req-004.json

@@ -0,0 +1,17 @@
+{
+  "reqId": "edge-cloudflare-turnstile-REQ-004",
+  "prdId": "PRD-001",
+  "title": "Composition with security-auth-magic-link: when both applied, the magic-link mint surface refuses submit without a valid Turnstile token",
+  "description": "When security-auth-magic-link and edge-cloudflare-turnstile are both applied, the magic-link mint surface reads through the Turnstile guard: a mint submit without a valid Turnstile response is refused with 400 before the mint fires. Composition uses the TAC-3603 hook.",
+  "category": "functional",
+  "domain": "edge",
+  "priority": "must",
+  "rationale": "Ratified in the Cloudflare round 6 spec (2026-09-06 section 5.5). Ships as v1.0.0 of edge-cloudflare-turnstile.",
+  "tags": [
+    "blueprint:edge-cloudflare-turnstile"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-07T20:00:00.000Z",
+  "updatedAt": "2026-09-07T20:00:00.000Z"
+}

package/blueprints/edge-cloudflare-turnstile/contributions/requirements/edge-cloudflare-turnstile-req-005.json

@@ -0,0 +1,17 @@
+{
+  "reqId": "edge-cloudflare-turnstile-REQ-005",
+  "prdId": "PRD-001",
+  "title": "Widget mode elicit: managed, non-interactive, invisible per Cloudflare Turnstile documented modes; recommendedDefault managed",
+  "description": "The applying operator elicits one of Cloudflare Turnstile documented widget modes: managed (default; challenge shown only when Cloudflare deems it necessary), non-interactive (always shows a non-interactive challenge) or invisible (mounts an invisible widget). The default mode is managed per ADR-3602.",
+  "category": "functional",
+  "domain": "edge",
+  "priority": "must",
+  "rationale": "Ratified in the Cloudflare round 6 spec (2026-09-06 section 5.5). Ships as v1.0.0 of edge-cloudflare-turnstile.",
+  "tags": [
+    "blueprint:edge-cloudflare-turnstile"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-07T20:00:00.000Z",
+  "updatedAt": "2026-09-07T20:00:00.000Z"
+}

package/blueprints/edge-cloudflare-turnstile/contributions/tacs/tac-3601-edge-cloudflare-turnstile-widget-mount.json

@@ -0,0 +1,26 @@
+{
+  "tacId": "TAC-3601-edge-cloudflare-turnstile-widget-mount",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "name": "Turnstile client widget mount with elicited sitekey and third-party script pin",
+  "purpose": "The client-side widget mount module for Cloudflare Turnstile. Mounts the Turnstile widget on elicited surfaces with the elicited TURNSTILE_SITEKEY. Injects only Cloudflare Turnstile JS from the Cloudflare Turnstile host (https://challenges.cloudflare.com/turnstile/v0/api.js per https://developers.cloudflare.com/turnstile/) and no other third-party script. Populates the hidden Cf-Turnstile-Response token field on submit. Widget mode is per ADR-3602 (managed, non-interactive, invisible).",
+  "responsibilities": [
+    "Render the Turnstile widget on every elicited surface with the elicited TURNSTILE_SITEKEY (AC-35101-1).",
+    "Inject only Cloudflare Turnstile JS from the Cloudflare Turnstile host; refuse any other third-party script.",
+    "Populate the hidden Cf-Turnstile-Response token field on the form payload before submit fires.",
+    "Honour the elicited widget mode enum: managed, non-interactive, invisible (AC-35106-1)."
+  ],
+  "internalStructure": "One client module realising the Turnstile mount. In the pack fixture the mount is inline in the served HTML for auditability; in an applied Workers project the mount ships as a small module the operator drops into the elicited surface.",
+  "interfaces": [
+    {
+      "name": "mountTurnstile",
+      "kind": "function",
+      "summary": "Mount the Turnstile widget onto a target element with the elicited sitekey and widget mode."
+    }
+  ],
+  "dependencies": [],
+  "createdAt": "2026-09-07T20:00:00.000Z",
+  "updatedAt": "2026-09-07T20:00:00.000Z"
+}

package/blueprints/edge-cloudflare-turnstile/contributions/tacs/tac-3602-edge-cloudflare-turnstile-server-verifier.json

@@ -0,0 +1,36 @@
+{
+  "tacId": "TAC-3602-edge-cloudflare-turnstile-server-verifier",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "name": "Turnstile server-side siteverify verifier and refuse-if-token-missing guard",
+  "purpose": "The server-side verifier module. POSTs {secret, response} to https://challenges.cloudflare.com/turnstile/v0/siteverify per Cloudflare Turnstile documented endpoint. On success:true proceeds; on success:false rejects 400 with error-codes body per ADR-3603. The refuse-if-token-missing guard is the sole reader of the Cf-Turnstile-Response payload field and rejects missing-token submits with 400 before any downstream handler runs.",
+  "responsibilities": [
+    "Own the ONLY reference to https://challenges.cloudflare.com/turnstile/v0/siteverify in the applied source tree (AC-35102-1, AC-35103-1).",
+    "Read TURNSTILE_SECRET only via env-shaped facade; refuse any inline literal (AC-35107-1).",
+    "Register the token-required guard at every elicited surface (AC-35104-1).",
+    "Emit event records with {sitekeyHash, outcome, timestamp} keys only; never carry the token or the secret (AC-35108-1)."
+  ],
+  "internalStructure": "One module (server verifier) exporting createTurnstileVerifier({env, eventSink, fetch}) returning {verify, guard}. The guard middleware rejects missing-token submits with a stable error-code before the verify branch runs. The event record is Object.frozen at the boundary so no downstream handler enriches it with a stray token slice.",
+  "interfaces": [
+    {
+      "name": "createTurnstileVerifier",
+      "kind": "factory",
+      "summary": "Turnstile server-side verifier over env.TURNSTILE_SECRET."
+    },
+    {
+      "name": "verifier.verify",
+      "kind": "method",
+      "summary": "POST {secret, response} to siteverify; returns {success, errorCodes}."
+    },
+    {
+      "name": "verifier.guard",
+      "kind": "method",
+      "summary": "Middleware that reads Cf-Turnstile-Response and rejects missing-token submits with 400."
+    }
+  ],
+  "dependencies": [],
+  "createdAt": "2026-09-07T20:00:00.000Z",
+  "updatedAt": "2026-09-07T20:00:00.000Z"
+}

package/blueprints/edge-cloudflare-turnstile/contributions/tacs/tac-3603-edge-cloudflare-turnstile-magic-link-hook.json

@@ -0,0 +1,25 @@
+{
+  "tacId": "TAC-3603-edge-cloudflare-turnstile-magic-link-hook",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "name": "Composition hook into security-auth-magic-link mint surface",
+  "purpose": "When security-auth-magic-link is applied alongside edge-cloudflare-turnstile, this hook registers the magic-link mint route under the Turnstile guard so a mint submit reads through the same token check. A missing or failed Turnstile response refuses the mint with 400 before the mint fires (AC-35105-1, AC-35105-2).",
+  "responsibilities": [
+    "Register the magic-link mint route under the Turnstile guard at composition apply time.",
+    "Refuse a mint submit without a valid Turnstile token with 400 before the mint fires.",
+    "Emit a mint-refused event record with the same {sitekeyHash, outcome, timestamp} shape as any other guard refusal."
+  ],
+  "internalStructure": "A thin registration hook that wraps the shipped magic-link mint handler with the Turnstile guard middleware. In the pack fixture the wiring is a one-line composeWithMagicLink({guard, mintHandler}) invocation on the route registration.",
+  "interfaces": [
+    {
+      "name": "composeWithMagicLink",
+      "kind": "function",
+      "summary": "Register the magic-link mint route under the Turnstile guard."
+    }
+  ],
+  "dependencies": [],
+  "createdAt": "2026-09-07T20:00:00.000Z",
+  "updatedAt": "2026-09-07T20:00:00.000Z"
+}

package/blueprints/edge-cloudflare-turnstile/contributions/user-stories/edge-cloudflare-turnstile-us-35101.json

@@ -0,0 +1,27 @@
+{
+  "usId": "edge-cloudflare-turnstile-US-35101",
+  "prdId": "PRD-001",
+  "reqId": "edge-cloudflare-turnstile-REQ-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Turnstile client widget mounts with the elicited sitekey and injects no third-party script beyond the Cloudflare Turnstile host",
+  "asA": "shelf consumer applying the edge-cloudflare-turnstile v1.0.0 blueprint on a Workers project using the probe-pack-edge-cloudflare-turnstile fixture",
+  "iWant": "the Turnstile widget to mount on my public form with the elicited TURNSTILE_SITEKEY, to inject only Cloudflare Turnstile JS and no other third-party script, and to populate the hidden Cf-Turnstile-Response token field on submit",
+  "soThat": "every submit that reaches my server carries a Turnstile response my server-side verifier can check and the browser has loaded no scripts I did not authorise",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-35101-1",
+      "description": "When the fixture page loads with the pinned always-pass test sitekey (1x00000000000000000000AA per https://developers.cloudflare.com/turnstile/troubleshooting/testing/), the Turnstile widget mounts and an iframe whose src origin is https://challenges.cloudflare.com is present; the page loads no third-party script from any other origin; the form payload on submit carries a non-empty Cf-Turnstile-Response value.",
+      "given": "the pack fixture form loaded with default sitekey=pass and the pinned always-pass test sitekey applied",
+      "when": "the widget renders and the operator submits",
+      "then": "the Turnstile widget is mounted, its iframe origin is Cloudflare Turnstile only, and the submit payload contains the Cf-Turnstile-Response token",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3601-edge-cloudflare-turnstile-widget-mount"
+  ],
+  "createdAt": "2026-09-07T20:00:00.000Z",
+  "updatedAt": "2026-09-07T20:00:00.000Z"
+}

package/blueprints/edge-cloudflare-turnstile/contributions/user-stories/edge-cloudflare-turnstile-us-35102.json

@@ -0,0 +1,27 @@
+{
+  "usId": "edge-cloudflare-turnstile-US-35102",
+  "prdId": "PRD-001",
+  "reqId": "edge-cloudflare-turnstile-REQ-002",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Server-side siteverify with the always-pass secret returns success true and the handler proceeds with 200",
+  "asA": "shelf consumer whose Worker verifies every Turnstile token server-side",
+  "iWant": "a POST to https://challenges.cloudflare.com/turnstile/v0/siteverify with the pinned always-pass secret (1x0000000000000000000000000000000AA) and any response token to return success:true and the handler to respond 200",
+  "soThat": "the verified path is exercised end-to-end against the live Cloudflare endpoint on every gate run",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-35102-1",
+      "description": "A live POST to https://challenges.cloudflare.com/turnstile/v0/siteverify with secret=1x0000000000000000000000000000000AA and any response token returns success:true; the pack-fixture /api/submit handler proceeds with 200 and the shipped Node probe siteverify-fixture asserts success:true.",
+      "given": "the pack fixture running on 127.0.0.1 on a free port with the pinned always-pass secret in the environment",
+      "when": "a submit hits /api/submit with any response token",
+      "then": "the server-side POST to siteverify returns success:true and the handler responds 200",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3602-edge-cloudflare-turnstile-server-verifier"
+  ],
+  "createdAt": "2026-09-07T20:00:00.000Z",
+  "updatedAt": "2026-09-07T20:00:00.000Z"
+}

package/blueprints/edge-cloudflare-turnstile/contributions/user-stories/edge-cloudflare-turnstile-us-35103.json

@@ -0,0 +1,27 @@
+{
+  "usId": "edge-cloudflare-turnstile-US-35103",
+  "prdId": "PRD-001",
+  "reqId": "edge-cloudflare-turnstile-REQ-002",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Server-side siteverify with the always-fail secret returns success false, the handler rejects 400, refusal body carries error-codes and no sitekey",
+  "asA": "shelf consumer whose Worker fails safe on every Turnstile refusal",
+  "iWant": "a POST to siteverify with the pinned always-fail secret to return success:false, the handler to reject with 400, and the refusal body to carry the documented error-codes value and never the sitekey",
+  "soThat": "every failure branch produces a stable machine-observable outcome and never leaks the sitekey or the response token",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-35103-1",
+      "description": "A live POST to siteverify with secret=2x0000000000000000000000000000000AA (always-fail secret per https://developers.cloudflare.com/turnstile/troubleshooting/testing/) returns success:false; the pack-fixture /api/submit handler rejects with 400 whose body carries the error-codes value (invalid-input-response) and no sitekey or secret substring.",
+      "given": "the pack fixture running with the pinned always-fail secret in the environment",
+      "when": "a submit hits /api/submit with any response token and the verifier calls siteverify",
+      "then": "siteverify returns success:false and the handler responds 400 with an error-codes body and no sitekey leak",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3602-edge-cloudflare-turnstile-server-verifier"
+  ],
+  "createdAt": "2026-09-07T20:00:00.000Z",
+  "updatedAt": "2026-09-07T20:00:00.000Z"
+}

package/blueprints/edge-cloudflare-turnstile/contributions/user-stories/edge-cloudflare-turnstile-us-35104.json

@@ -0,0 +1,27 @@
+{
+  "usId": "edge-cloudflare-turnstile-US-35104",
+  "prdId": "PRD-001",
+  "reqId": "edge-cloudflare-turnstile-REQ-003",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Refuse-if-token-missing guard rejects submit with 400 before any downstream handler runs",
+  "asA": "shelf consumer whose Worker rejects cheap missing-token submit attempts at the earliest possible boundary",
+  "iWant": "a source-tree scan to enumerate every elicited surface and confirm each carries a token-required guard, and a live missing-token submit to be refused with 400 with no downstream side-effect",
+  "soThat": "no downstream handler ever executes against a missing-token submit",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-35104-1",
+      "description": "The Node probe guard-shape-scan enumerates every elicited surface in the pack fixture source and asserts each is registered under the token-required guard. A live POST to /api/submit without a Cf-Turnstile-Response field is rejected with 400 and refusal body carries error-code turnstile.token-missing; no downstream handler side-effect is observable.",
+      "given": "the pack fixture running with every elicited surface registered under the token-required guard",
+      "when": "a submit reaches /api/submit without a Cf-Turnstile-Response value",
+      "then": "the guard rejects with 400 with an error-code body and no downstream handler runs",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3602-edge-cloudflare-turnstile-server-verifier"
+  ],
+  "createdAt": "2026-09-07T20:00:00.000Z",
+  "updatedAt": "2026-09-07T20:00:00.000Z"
+}

package/blueprints/edge-cloudflare-turnstile/contributions/user-stories/edge-cloudflare-turnstile-us-35105.json

@@ -0,0 +1,36 @@
+{
+  "usId": "edge-cloudflare-turnstile-US-35105",
+  "prdId": "PRD-001",
+  "reqId": "edge-cloudflare-turnstile-REQ-004",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Composition with security-auth-magic-link gates the magic-link mint surface behind the Turnstile guard",
+  "asA": "shelf consumer applying both security-auth-magic-link and edge-cloudflare-turnstile",
+  "iWant": "the magic-link mint surface to be registered under the Turnstile guard so a mint submit reads through the same token check as any other elicited surface, and a mint without a valid Turnstile token to be refused with 400 before the mint fires",
+  "soThat": "magic-link mint requests are protected by the same human-check as any other public form",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-35105-1",
+      "description": "The pack fixture ships a /api/magic-link mint stub route registered under the Turnstile guard. A source-tree read of the composition wire confirms the mint surface reads the Turnstile guard before invoking the magic-link mint.",
+      "given": "the pack fixture with both blueprints applied and /api/magic-link registered under the token-required guard",
+      "when": "the composition wire is walked in the source tree",
+      "then": "the magic-link mint surface reads the Turnstile guard before invoking the mint",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-35105-2",
+      "description": "A live POST to /api/magic-link without a Cf-Turnstile-Response field, and a POST carrying the always-fail response token that fails siteverify, are both refused with 400 by the Turnstile guard and no magic-link mint side-effect is observable. The Playwright pack check magicLinkGuard drives this against the fixture with a real browser.",
+      "given": "the pack fixture running with both blueprints applied and a real Playwright browser driving the fixture",
+      "when": "a magic-link mint submit is issued without a Turnstile response, or with the always-fail response token",
+      "then": "the Turnstile guard refuses with 400 and no magic-link mint side-effect is observable",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3603-edge-cloudflare-turnstile-magic-link-hook"
+  ],
+  "createdAt": "2026-09-07T20:00:00.000Z",
+  "updatedAt": "2026-09-07T20:00:00.000Z"
+}

package/blueprints/edge-cloudflare-turnstile/contributions/user-stories/edge-cloudflare-turnstile-us-35106.json

@@ -0,0 +1,27 @@
+{
+  "usId": "edge-cloudflare-turnstile-US-35106",
+  "prdId": "PRD-001",
+  "reqId": "edge-cloudflare-turnstile-REQ-005",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Widget mode is elicited as an enum (managed, non-interactive, invisible); default managed and each mode renders per Cloudflare documented modes",
+  "asA": "shelf consumer selecting a Turnstile widget mode for the applied surface",
+  "iWant": "to elicit one of managed, non-interactive or invisible at apply time with managed as the recommendedDefault, and to see each mode render as Cloudflare documents",
+  "soThat": "the applied widget mode matches the operational profile my site needs",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-35106-1",
+      "description": "The blueprint elicit widget-mode is enum with values managed, non-interactive, invisible; recommendedDefault managed per ADR-3602. The pack fixture accepts ?mode=<managed|non-interactive|invisible> and mounts the widget with the pinned invisible-widget test sitekeys (1x00000000000000000000BB, 2x00000000000000000000BB per https://developers.cloudflare.com/turnstile/troubleshooting/testing/). Each mode renders the Turnstile iframe from https://challenges.cloudflare.com and no other origin.",
+      "given": "the pack fixture loaded with mode=managed, mode=non-interactive and mode=invisible respectively",
+      "when": "each variant renders",
+      "then": "each renders the Turnstile widget from Cloudflare Turnstile origin only and no third-party script is loaded",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3601-edge-cloudflare-turnstile-widget-mount"
+  ],
+  "createdAt": "2026-09-07T20:00:00.000Z",
+  "updatedAt": "2026-09-07T20:00:00.000Z"
+}

package/blueprints/edge-cloudflare-turnstile/contributions/user-stories/edge-cloudflare-turnstile-us-35107.json

@@ -0,0 +1,27 @@
+{
+  "usId": "edge-cloudflare-turnstile-US-35107",
+  "prdId": "PRD-001",
+  "reqId": "edge-cloudflare-turnstile-REQ-002",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "TURNSTILE_SECRET is read only via the applied secrets facade and never inlined in fixture source",
+  "asA": "reviewer auditing the applied Workers project for secret hygiene",
+  "iWant": "the TURNSTILE_SECRET to be dereferenced only via process.env or an env-shaped facade and no plain-text secret literal in the fixture source",
+  "soThat": "the Turnstile secret is never committed to the applying project source tree",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-35107-1",
+      "description": "A source-tree AST scan of the pack fixture (packages/rcf-lite/test/fixtures/probe-pack-edge-cloudflare-turnstile) asserts that TURNSTILE_SECRET is read only via env-shaped identifiers (process.env.TURNSTILE_SECRET or an env facade) and that no plain-string secret literal appears in the fixture source; the Node probe secret-shape-scan implements the assertion and exits 0.",
+      "given": "the shipped pack fixture with the pinned test secrets sourced from environment",
+      "when": "the source-tree AST scan runs over the fixture",
+      "then": "the scan finds only env-shaped reads for TURNSTILE_SECRET and reports no plain-string secret literal",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3602-edge-cloudflare-turnstile-server-verifier"
+  ],
+  "createdAt": "2026-09-07T20:00:00.000Z",
+  "updatedAt": "2026-09-07T20:00:00.000Z"
+}

package/blueprints/edge-cloudflare-turnstile/contributions/user-stories/edge-cloudflare-turnstile-us-35108.json

@@ -0,0 +1,27 @@
+{
+  "usId": "edge-cloudflare-turnstile-US-35108",
+  "prdId": "PRD-001",
+  "reqId": "edge-cloudflare-turnstile-REQ-002",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Event records carry sitekeyHash, outcome and timestamp only; no token and no secret",
+  "asA": "reviewer auditing the applied Workers project for observability hygiene",
+  "iWant": "every event record produced by a Turnstile verification to carry sitekeyHash, outcome and timestamp only and never carry the token or the secret value",
+  "soThat": "the observability tier never sees the raw Turnstile response or the Turnstile secret",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-35108-1",
+      "description": "The Node probe event-secrecy drives siteverify against Cloudflare with the pinned test keys and asserts every event record carries {sitekeyHash, outcome, timestamp} keys only; no record carries the token, no record carries the secret, and no forbidden substring is present in the serialised record.",
+      "given": "the pack fixture running with the event-secrecy probe attached and the pinned test keys in the environment",
+      "when": "the probe drives one pass and one fail through the verifier",
+      "then": "every emitted event carries only sitekeyHash, outcome and timestamp",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3602-edge-cloudflare-turnstile-server-verifier"
+  ],
+  "createdAt": "2026-09-07T20:00:00.000Z",
+  "updatedAt": "2026-09-07T20:00:00.000Z"
+}

package/blueprints/edge-cloudflare-turnstile/docs/topics.md

@@ -0,0 +1,68 @@
+# edge-cloudflare-turnstile blueprint coordination vocabulary
+
+This file is the edge-cloudflare-turnstile half of the cross-blueprint contract. The Phase 1 conflict detector matches scope:global ADR topics by EXACT string equality, and AC ids are unnamespaced by the 0.4.4 grammar. Any blueprint intended to compose with this one must reuse these exact strings and respect these bands.
+
+## Global ADR topics this blueprint contributes (exact strings)
+
+| Topic string | edge-cloudflare-turnstile contribution | Origin | Composition note |
+|---|---|---|---|
+| `humanVerificationGate` | ADR-3601-edge-cloudflare-turnstile-verifier-contract | Minted by this blueprint. Names the wire-shape contract for the project-wide human verification gate; the shipped answer is Cloudflare Turnstile with server-side siteverify per `https://developers.cloudflare.com/turnstile/`. | The one project-wide decision on the human verification gate at the shipped-shape boundary. A future non-Cloudflare sibling (hCaptcha, reCAPTCHA) would contribute the same topic string with a different answer, forcing a DELIBERATE conflict the operator resolves with a project-level ADR. |
+
+The edge-cloudflare-turnstile blueprint claims one global topic (minted here, shipped as the Cloudflare Turnstile siteverify verifier). ADR-3602 widget mode and ADR-3603 refuse shape do not contribute global topics; a composing blueprint that holds an opinion on either authors its own project-level ADR.
+
+Rules for new topics: lower camel case, one concept per topic, no version suffixes. A topic names the decision area, not the chosen answer.
+
+## Id number bands (registry bootstrap)
+
+This table is maintained shelf-wide across every blueprint's `docs/topics.md`. Rows are recorded at ship, never predicted.
+
+| Blueprint | US band | ADR/TAC suffix block | Status | Global topics |
+|---|---|---|---|---|
+| application-spa | 1101-1899 | 2xx | shipped v1.3.0 | `clientRouting`, `theming`, `clientState`, `errorEnvelope`, `authModel` |
+| application-api-rest | 2101-2899 | 3xx | shipped v1.0.0 | `errorEnvelope`, `authModel`, `apiVersioning`, `logging` |
+| security-auth-magic-link | 3101-3899 | 5xx | shipped v1.2.0 | `authModel` |
+| email-smtp-resend | 4101-4899 | 4xx | shipped v1.0.0 | none |
+| hello-panel (walkthrough exemplar) | 4101-4899 | 4xx | doc-reserved; teaching exemplar in `packages/rcf-lite/docs/blueprint-authoring-walkthrough.md`, not shipped as a blueprint directory | `operatorPanel` |
+| persistence-data-sqlite | 5101-5899 | 6xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
+| delivery-ci-workflows | 6101-6899 | 7xx | shipped v2.0.0 (renamed from ci-pipeline) | `ciGates`, `strictCoverageGate`, `releaseArtefacts` |
+| observability-essentials | 7101-7899 | 8xx | shipped v2.0.0 | `statusPageContract` |
+| security-secrets-management | 8101-8899 | 9xx | shipped v1.0.1 | `secretsSource` |
+| security-auth-clerk | 9101-9899 | 10xx | shipped v1.0.0 | `authModel` |
+| security-auth-oauth2 | 10101-10899 | 11xx | shipped v1.0.0 | `authModel` |
+| security-auth-keycloak | 11101-11899 | 12xx | shipped v1.0.0 | `authModel` |
+| deploy-cloudflare-workers | 12101-12899 | 13xx | shipped v1.2.0 | `deploymentTarget` |
+| persistence-data-d1 | 13101-13899 | 14xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
+| observability-probe-endpoints | 14101-14899 | 15xx | shipped v1.1.0 | `healthProbes`, `readinessSemantics` |
+| observability-logging | 15101-15899 | 16xx | shipped v1.0.0 | `logging` |
+| application-error-handling | 16101-16899 | 17xx | shipped v1.0.0 | `errorHandling` |
+| application-datatable | 17101-17899 | 18xx | shipped v1.0.0 | none |
+| application-charts | 18101-18899 | 19xx | shipped v1.0.0 | none |
+| application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
+| application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
+| application-admin-console | 21101-21899 | 22xx | shipped v1.1.0 | `adminConsoleSignInSurface` |
+| application-empty-error-states | 22101-22899 | 23xx | shipped v1.0.0 | none |
+| application-file-upload | 23101-23899 | 24xx | shipped v1.0.0 | none |
+| application-forms-wizard | 24101-24899 | 25xx | shipped v1.0.0 | none |
+| application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
+| application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
+| persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
+| jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
+| platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
+| platform-cloudflare-cron-triggers | 32101-32899 | 33xx | shipped v1.0.0 | `scheduledTriggerContract` |
+| platform-cloudflare-durable-objects | 33101-33899 | 34xx | shipped v1.0.0 | `strongConsistencyCellContract`, `websocketHubContract` |
+| edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
+| edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
+| edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
+
+US 35101-35108 sit at the LOW end of the 35101-35899 band on purpose (watchpost run-4 lesson). ADR/TAC suffixes for this blueprint use the 3601-3699 block, continuing the shelf pattern.
+
+## Shared expectations for future composing blueprints
+
+- Reuse `humanVerificationGate` exactly as spelled here when your blueprint holds an opinion on the human verification gate contract; contribute your own scope:global ADR on that string and let composition surface the pairing.
+- Consumer blueprints reading the `humanCheck` capability declared on `blueprint.json` per section 6a of `blueprint-authoring.md` obtain the Turnstile-guarded composition at apply time via the capability-declaration mechanism.
+
+## Deliberate-conflict statement
+
+This blueprint's ADR-3601 on `humanVerificationGate` is the first shipped answer to a topic that will conflict, by design, with future non-Cloudflare siblings. Applying `edge-cloudflare-turnstile` alongside such a sibling would raise a `globalAdrTopic` conflict the operator resolves via one of the four documented resolutions (adopt one, keep the existing one, author a project-level supersede ADR, or `--resolve <topic>=project:<ADR-id>` on the add).

package/blueprints/edge-cloudflare-turnstile/guide/edge-cloudflare-turnstile.md

@@ -0,0 +1,104 @@
+# edge-cloudflare-turnstile guide
+
+This guide walks the operator through applying the `edge-cloudflare-turnstile` v1.0.0 blueprint to a Workers project, wiring the client widget mount, calling the server-side siteverify, refusing missing-token submits, and composing the guard with `security-auth-magic-link` on the mint surface.
+
+## 1. Prerequisites
+
+- A Cloudflare Turnstile widget (sitekey and paired secret). Cloudflare documents issuing at `https://developers.cloudflare.com/turnstile/`. For CI and development, the fixture pins the always-pass and always-fail public test keys documented at `https://developers.cloudflare.com/turnstile/troubleshooting/testing/`.
+- A Cloudflare Workers project (`deploy-cloudflare-workers` applied) or the shipped pack fixture at `packages/rcf-lite/test/fixtures/probe-pack-edge-cloudflare-turnstile/`.
+
+## 2. Apply the blueprint
+
+At apply time the blueprint elicits four values:
+
+| Elicit | Answer |
+|---|---|
+| `turnstile-sitekey` | The Cloudflare Turnstile sitekey the widget renders with. |
+| `turnstile-secret` | The paired secret. Store through the applied `security-secrets-management` companion. |
+| `turnstile-widget-mode` | One of `managed` (default), `non-interactive`, `invisible`. |
+| `turnstile-guarded-surfaces` | Comma-separated list of applied route ids the guard registers on. |
+
+## 3. Client widget mount snippet
+
+Paste the following into the public form surface. The mount injects Cloudflare Turnstile JS from `https://challenges.cloudflare.com` and populates the `cf-turnstile-response` hidden input on submit.
+
+```html
+<script src="https://challenges.cloudflare.com/turnstile/v0/api.js" async defer></script>
+<form method="post" action="/api/submit">
+  <label>Email <input type="email" name="email" required></label>
+  <div class="cf-turnstile"
+       data-sitekey="YOUR_TURNSTILE_SITEKEY"
+       data-callback="onTurnstileToken"></div>
+  <button type="submit">Submit</button>
+</form>
+<script>
+window.onTurnstileToken = function (token) {
+  var f = document.querySelector('form');
+  var i = f.querySelector('input[name="cf-turnstile-response"]');
+  if (!i) {
+    i = document.createElement('input');
+    i.type = 'hidden';
+    i.name = 'cf-turnstile-response';
+    f.appendChild(i);
+  }
+  i.value = token;
+};
+</script>
+```
+
+## 4. Server-side siteverify
+
+Every submit is verified server-side by POSTing to Cloudflare's siteverify endpoint per `https://developers.cloudflare.com/turnstile/`. On `success:true` the handler proceeds; on `success:false` the handler rejects with 400 and the refusal body carries the documented `error-codes` value.
+
+`curl` example:
+
+```
+curl -sS -X POST https://challenges.cloudflare.com/turnstile/v0/siteverify \
+  -d "secret=$TURNSTILE_SECRET" \
+  -d "response=$CLIENT_TOKEN"
+```
+
+Response on pass:
+
+```
+{"success":true,"challenge_ts":"...","hostname":"..."}
+```
+
+Response on fail:
+
+```
+{"success":false,"error-codes":["invalid-input-response"]}
+```
+
+## 5. Refuse-if-token-missing guard
+
+Every elicited surface is registered under the token-required guard. A submit whose payload has no `cf-turnstile-response` field is refused with `400 {"errorCode":"turnstile.token-missing"}` before any downstream handler runs. The pack fixture (`packages/rcf-lite/test/fixtures/probe-pack-edge-cloudflare-turnstile/server.js`) is the reference wiring; the applied Worker mirrors the shape.
+
+## 6. Composition with security-auth-magic-link
+
+When `security-auth-magic-link` is also applied, the composition hook (`TAC-3603`) registers the magic-link mint route under the Turnstile guard. The mint reads the Turnstile token check before invoking the mint. Example:
+
+```
+POST /api/magic-link
+Content-Type: application/x-www-form-urlencoded
+
+email=alice@example.com&cf-turnstile-response=<TOKEN>
+```
+
+- Missing token: `400 {"errorCode":"turnstile.token-missing"}` with no mint side-effect.
+- Failed siteverify: `400 {"errorCode":"turnstile.siteverify-failed","errorCodes":[...]}` with no mint side-effect.
+- Pass: `200 {"mint":"ok"}` and the magic-link mint fires.
+
+## 7. Widget mode
+
+Cloudflare Turnstile documents three widget modes per `https://developers.cloudflare.com/turnstile/`: `managed` (Cloudflare decides when to render a challenge), `non-interactive` (always shows a non-interactive challenge) and `invisible` (invisible widget). The blueprint elicits the mode; the shipped default is `managed`.
+
+The pack fixture accepts `?mode=<managed|non-interactive|invisible>` for a per-page-load override.
+
+## 8. Test keys and CI
+
+For CI or development the fixture pins Cloudflare's public test keys per `https://developers.cloudflare.com/turnstile/troubleshooting/testing/`. The always-pass sitekey `1x00000000000000000000AA` and always-fail sitekey `2x00000000000000000000AB` drive the deterministic branches of the shipped probes. No real Turnstile credentials are required for the pack to run.
+
+## 9. Observability
+
+Every event record carries `sitekeyHash`, `outcome` and `timestamp` keys only. The token and the secret are never in the record. The `event-secrecy` probe asserts this shape on every apply.