rcf-lite 0.23.0 → 0.25.0

package/rcf/user-stories/us-8101.json

@@ -0,0 +1,24 @@
+{
+  "createdAt": "2026-09-07T16:49:30.157Z",
+  "updatedAt": "2026-09-07T16:51:52.835Z",
+  "usId": "US-8101",
+  "prdId": "PRD-001",
+  "reqId": "REQ-081",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-4 Access application declared with elicited hostname or self-hosted-app id and elicited policy shape",
+  "asA": "operator applying the edge-cloudflare-access v1.0.0 blueprint",
+  "iWant": "the blueprint to elicit either an Access application hostname or a self-hosted-app id, plus a policy shape from the enum",
+  "soThat": "the apply record captures the exact Access application declaration the operator will issue in the Zero Trust dashboard or over the API",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-8101-1",
+      "description": "blueprint.json elicits access-application-host (kind string) or access-selfhosted-app-id (kind string, one of the two required at apply), plus access-policy-shape (kind enum, options email-domain, service-token-only, service-token-plus-email-domain, group-membership; recommended default email-domain). Applying the blueprint records the elicited values on rcf/blueprints/edge-cloudflare-access.applied.json.",
+      "given": "the blueprint.json elicits block",
+      "when": "the apply verb runs against a fixture project",
+      "then": "rcf/blueprints/edge-cloudflare-access.applied.json carries appliedCapabilities=[zeroTrustGate] and elicited values for access-application-host or access-selfhosted-app-id plus access-policy-shape",
+      "testable": true,
+      "scope": "library"
+    }
+  ]
+}

package/rcf/user-stories/us-8201.json

@@ -0,0 +1,24 @@
+{
+  "createdAt": "2026-09-07T16:49:30.372Z",
+  "updatedAt": "2026-09-07T16:51:53.022Z",
+  "usId": "US-8201",
+  "prdId": "PRD-001",
+  "reqId": "REQ-082",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-4 operator issues a Zero Trust policy via the guide's dashboard walk-through or the alternative API path",
+  "asA": "operator applying the edge-cloudflare-access v1.0.0 blueprint",
+  "iWant": "the guide to walk me through issuing the Zero Trust policy on the Cloudflare dashboard AND to document the alternative API path",
+  "soThat": "the policy issuance flow is unambiguous whether I use the dashboard or the API",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-8201-1",
+      "description": "The shipped guide/edge-cloudflare-access.md carries a section Zero Trust dashboard walk-through with numbered steps naming each screen; and a section API alternative with a curl example against https://api.cloudflare.com/client/v4/accounts/{account_id}/access/apps/{app_id}/policies; the vendor URL https://developers.cloudflare.com/cloudflare-one/policies/access/ is cited from ADR-3501 and the guide.",
+      "given": "the shipped guide file",
+      "when": "the anatomy test greps for the two section headings, the curl example and the vendor URL",
+      "then": "each string matches at least once in the file",
+      "testable": true,
+      "scope": "library"
+    }
+  ]
+}

package/rcf/user-stories/us-8301.json

@@ -0,0 +1,24 @@
+{
+  "createdAt": "2026-09-07T16:49:30.586Z",
+  "updatedAt": "2026-09-07T16:51:27.145Z",
+  "usId": "US-8301",
+  "prdId": "PRD-001",
+  "reqId": "REQ-083",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-4 audit event carries only email, outcome, timestamp and path; no token value or headers on any code path",
+  "asA": "shelf consumer applying the edge-cloudflare-access v1.0.0 blueprint on a Workers project using the cf-edge fixture",
+  "iWant": "the audit sink to receive only metadata-only records for every validate-pass and validate-reject",
+  "soThat": "the audit trail is observable without leaking the JWT, its signature bytes or any request header value",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-8301-1",
+      "description": "After 5 validate-pass and 5 validate-reject requests the audit sink holds 10 records each carrying exactly {email, outcome, timestamp, path}; the serialised JSON of every record contains no substring of the JWT (header, payload or signature), no Authorization value and no header names beyond path.",
+      "given": "the shipped createAccessValidator wired with a spy audit sink and 10 requests (5 pass, 5 reject)",
+      "when": "the requests dispatch through the validator",
+      "then": "10 sink records, each with allowed keys only, none containing forbidden substrings",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ]
+}

package/rcf/user-stories/us-8401.json

@@ -0,0 +1,24 @@
+{
+  "createdAt": "2026-09-07T16:49:30.802Z",
+  "updatedAt": "2026-09-07T16:51:27.332Z",
+  "usId": "US-8401",
+  "prdId": "PRD-001",
+  "reqId": "REQ-084",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-4 break-glass posture: an elicited bypass-service-auth token pair signs CI automation requests through the validator",
+  "asA": "operator running CI-signed automation against an Access-gated Worker",
+  "iWant": "an elicited bypass-service-auth token pair that the validator recognises and passes through as an authenticated principal",
+  "soThat": "CI can hit the gated Worker without a browser flow while every bypass leaves a distinct audit trace",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-8401-1",
+      "description": "When the request presents the elicited service-auth id and secret (as CF-Access-Client-Id and CF-Access-Client-Secret headers), the validator observes the pair, records outcome=bypass in the audit event with the same metadata-only shape, and delegates to the handler as authenticated with request.auth.email='service:'+id. Break-glass is disabled unless the elicited pair is applied.",
+      "given": "the createAccessValidator wired with an elicited bypass-service-auth pair and a request presenting the paired headers",
+      "when": "the request dispatches through the validator",
+      "then": "the handler receives request.auth with the service principal and the audit sink records outcome=bypass, with allowed keys only",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ]
+}

package/rcf/user-stories/us-8501.json

@@ -0,0 +1,24 @@
+{
+  "createdAt": "2026-09-07T16:49:31.016Z",
+  "updatedAt": "2026-09-07T16:51:27.519Z",
+  "usId": "US-8501",
+  "prdId": "PRD-001",
+  "reqId": "REQ-085",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-4 admin-console composition: the sign-in surface swaps to Access-gated when zeroTrustGate applied and falls back to security-auth-* otherwise",
+  "asA": "shelf consumer applying both edge-cloudflare-access and application-admin-console v1.1.0",
+  "iWant": "the admin-console sign-in surface to flip to Access-gated when zeroTrustGate is applied, and to fall back to the local security-auth-* surface otherwise",
+  "soThat": "the composition is deterministic and no local login form leaks into an Access-gated deployment",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-8501-1",
+      "description": "Two applied combinations are exercised on the extended admin-console fixture: with ?caps=principalDirectory,roleModel,auditLog,zeroTrustGate the sign-in surface renders [data-surface=access-gated] and no [data-surface=local-login] is present; with ?caps=principalDirectory,roleModel,auditLog the sign-in surface renders [data-surface=local-login] and no [data-surface=access-gated] is present. Both combinations exercise the shipped pack check AC-21815-1.",
+      "given": "the admin-console pack fixture with the two caps combinations",
+      "when": "the pack runs against each combination",
+      "then": "AC-21815-1 fires on the gated combination and passes; the existing v1.0.0 surface renders on the non-gated combination and its own check passes",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ]
+}

package/rcf/user-stories/us-8502.json

@@ -0,0 +1,24 @@
+{
+  "createdAt": "2026-09-07T16:49:31.234Z",
+  "updatedAt": "2026-09-07T16:51:27.703Z",
+  "usId": "US-8502",
+  "prdId": "PRD-001",
+  "reqId": "REQ-085",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-4 real-account gated URL: a request against a scheduled Access-configured hostname lands the Access UI",
+  "asA": "HQ operator running the real-account gated-URL smoke against a scheduled Access-configured hostname",
+  "iWant": "the probe to fire against the hostname when the env vars are present and record accountBoundSkipped when not",
+  "soThat": "the mechanism-reach claim is proven on a real Cloudflare Access instance without ever failing the shelf gate on the absence of an account",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-8502-1",
+      "description": "With CI_HAS_CLOUDFLARE_ACCOUNT=true and CF_ACCESS_HOST=<hostname>, a plain fetch against https://<hostname>/ follows the redirect chain and terminates at an https://<team>.cloudflareaccess.com/ URL (the Access UI). Without either env var the probe records accountBoundSkipped=true and aggregateVerdict=pass per spec section 3.5.",
+      "given": "the run-real-account-gated-url.mjs probe shim and the two env vars",
+      "when": "the probe runs",
+      "then": "in the CI-with-account path the redirect chain reports cloudflareaccess.com as terminal; in the without-env path accountBoundSkipped is true",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ]
+}

package/rcf/user-stories/us-8601.json

@@ -0,0 +1,24 @@
+{
+  "createdAt": "2026-09-07T16:49:31.448Z",
+  "updatedAt": "2026-09-07T16:51:53.213Z",
+  "usId": "US-8601",
+  "prdId": "PRD-001",
+  "reqId": "REQ-086",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-4 admin-console v1.1.0: Access-gated sign-in surface with no local login form and principal reads from request.auth",
+  "asA": "shelf consumer applying application-admin-console v1.1.0 with zeroTrustGate in the applied capability set",
+  "iWant": "the sign-in surface to render as Access-gated with no local login form and to read the principal from request.auth",
+  "soThat": "the admin console composes with edge-cloudflare-access at the sign-in seam and never re-collects credentials in an Access-gated deployment",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-8601-1",
+      "description": "The repo-chain AC for the admin-console v1.1.0 Access-gated sign-in surface. The shipped pack check on application-admin-console.pack.mjs (id AC-21815-1 in the blueprint's own band) asserts that when application-admin-console v1.1.0 is applied with zeroTrustGate in appliedCapabilities, GET /admin/sign-in renders a region with [data-surface=access-gated], no [data-surface=local-login] region is present, and a [data-role=principal-read] element renders the principal email read from request.auth.",
+      "given": "the extended admin-console pack fixture on ?caps=principalDirectory,roleModel,auditLog,zeroTrustGate",
+      "when": "the pack drives GET /admin/sign-in",
+      "then": "the DOM carries [data-surface=access-gated], no [data-surface=local-login], and a [data-role=principal-read] with the request.auth email",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ]
+}

package/rcf/user-stories/us-8602.json

@@ -0,0 +1,24 @@
+{
+  "createdAt": "2026-09-07T16:49:31.662Z",
+  "updatedAt": "2026-09-07T16:51:28.075Z",
+  "usId": "US-8602",
+  "prdId": "PRD-001",
+  "reqId": "REQ-086",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-4 admin-console v1.1.0: falls back to security-auth-* sign-in surface when zeroTrustGate absent",
+  "asA": "shelf consumer applying application-admin-console v1.1.0 WITHOUT zeroTrustGate in the applied capability set",
+  "iWant": "the sign-in surface to render as the local security-auth-* surface with no Access-gated region",
+  "soThat": "the v1.1.0 admin-console remains backward-compatible with every v1.0.0 deployment that never adopted Access",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-8602-1",
+      "description": "When application-admin-console v1.1.0 is applied without zeroTrustGate in appliedCapabilities, GET /admin/sign-in renders a region with [data-surface=local-login] and no [data-surface=access-gated] region is present.",
+      "given": "the extended admin-console pack fixture on ?caps=principalDirectory,roleModel,auditLog",
+      "when": "the pack drives GET /admin/sign-in",
+      "then": "the DOM carries [data-surface=local-login] and no [data-surface=access-gated]",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ]
+}

package/rcf/user-stories/us-9001.json

@@ -0,0 +1,27 @@
+{
+  "createdAt": "2026-09-07T19:54:01.850Z",
+  "updatedAt": "2026-09-07T19:56:38.973Z",
+  "asA": "shelf consumer applying the edge-cloudflare-turnstile v1.0.0 blueprint on a Workers project using the probe-pack-edge-cloudflare-turnstile fixture",
+  "iWant": "the Turnstile widget to mount on my public form with the elicited TURNSTILE_SITEKEY, to inject only Cloudflare Turnstile JS (no other third-party script), and to populate the hidden Cf-Turnstile-Response token field on submit",
+  "soThat": "every submit that reaches my server carries a Turnstile response my server-side verifier can check",
+  "usId": "US-9001",
+  "prdId": "PRD-001",
+  "reqId": "REQ-090",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-5 widget mount: elicited sitekey renders Turnstile widget with token populated on submit",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-9001-1",
+      "description": "When the fixture page loads with the always-pass test sitekey, the Turnstile widget mounts and an iframe is present whose src origin is https://challenges.cloudflare.com; the page loads no third-party script from any other origin; on submit the form payload carries a non-empty Cf-Turnstile-Response value.",
+      "given": "the pack fixture form loaded with default sitekey pass and the pinned always-pass test sitekey",
+      "when": "the widget renders and the operator submits",
+      "then": "the Turnstile widget is mounted, its iframe origin is Cloudflare Turnstile only, and the submit payload contains the Cf-Turnstile-Response token",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3601-edge-cloudflare-turnstile-widget-mount"
+  ]
+}

package/rcf/user-stories/us-9002.json

@@ -0,0 +1,27 @@
+{
+  "createdAt": "2026-09-07T19:56:35.026Z",
+  "updatedAt": "2026-09-07T19:56:39.157Z",
+  "asA": "reviewer auditing the applied Workers project source for secret hygiene",
+  "iWant": "the TURNSTILE_SECRET to be read through the elicited config or applied secrets facade, and to see no plain-text secret literal in the fixture source",
+  "soThat": "the Turnstile secret is never committed to the applying project source tree",
+  "usId": "US-9002",
+  "prdId": "PRD-001",
+  "reqId": "REQ-090",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-5 secret shape: TURNSTILE_SECRET is read only via the applied secrets facade and never inlined in fixture source",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-9002-1",
+      "description": "A source-tree AST scan of the pack fixture (packages/rcf-lite/test/fixtures/probe-pack-edge-cloudflare-turnstile) asserts that TURNSTILE_SECRET is dereferenced only via process.env or an env-shaped facade and that no plain-string secret literal appears in the fixture source. The Node probe secret-shape-scan implements the assertion and exits 0 on the fixture.",
+      "given": "the shipped pack fixture with the pinned test secret sourced from environment",
+      "when": "the source-tree AST scan runs over the fixture",
+      "then": "the scan finds only env-shaped reads for TURNSTILE_SECRET and reports no plain-string secret literal",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3602-edge-cloudflare-turnstile-server-verifier"
+  ]
+}

package/rcf/user-stories/us-9101.json

@@ -0,0 +1,27 @@
+{
+  "createdAt": "2026-09-07T19:56:35.429Z",
+  "updatedAt": "2026-09-07T19:56:39.347Z",
+  "asA": "shelf consumer whose Worker verifies Turnstile tokens through the shipped verifier",
+  "iWant": "a POST to challenges.cloudflare.com/turnstile/v0/siteverify with the pinned always-pass secret and any response token to return success true and my handler to respond 200",
+  "soThat": "the Turnstile-verified path is exercised end-to-end against the real Cloudflare endpoint",
+  "usId": "US-9101",
+  "prdId": "PRD-001",
+  "reqId": "REQ-091",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-5 server-side siteverify pass: the always-pass Turnstile secret returns success:true and the handler proceeds with 200",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-9101-1",
+      "description": "A live POST to https://challenges.cloudflare.com/turnstile/v0/siteverify with secret=1x0000000000000000000000000000000AA and any response token returns success:true; the pack-fixture /api/submit handler proceeds with 200. The Node siteverify-fixture probe drives the live endpoint and asserts success:true.",
+      "given": "the pack fixture running on 127.0.0.1 with the pinned always-pass secret in the environment",
+      "when": "a form submit hits /api/submit carrying the always-pass response token",
+      "then": "the server-side POST to Cloudflare returns success:true and the handler responds 200",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3602-edge-cloudflare-turnstile-server-verifier"
+  ]
+}

package/rcf/user-stories/us-9102.json

@@ -0,0 +1,27 @@
+{
+  "createdAt": "2026-09-07T19:56:35.831Z",
+  "updatedAt": "2026-09-07T19:56:39.532Z",
+  "asA": "shelf consumer whose Worker fails safe on any Turnstile verification refusal",
+  "iWant": "a POST to siteverify with the pinned always-fail secret to return success false, the handler to reject with 400, and every event record to carry only sitekeyHash, outcome and timestamp",
+  "soThat": "the fail branch never leaks the secret or the response token into observability",
+  "usId": "US-9102",
+  "prdId": "PRD-001",
+  "reqId": "REQ-091",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-5 server-side siteverify fail: the always-fail Turnstile secret returns success:false, the handler rejects 400, and event records carry no token or secret",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-9102-1",
+      "description": "A live POST to siteverify with secret=2x0000000000000000000000000000000AA returns success:false; the pack-fixture /api/submit handler rejects with 400 whose body carries the error-codes value, not the sitekey. The Node event-secrecy probe asserts that every event record captured on submit carries {sitekeyHash, outcome, timestamp} keys only and does not carry the token or the secret string.",
+      "given": "the pack fixture running with the pinned always-fail secret in the environment and event-secrecy probe attached",
+      "when": "a form submit hits /api/submit and the verifier calls siteverify",
+      "then": "siteverify returns success:false, the handler responds 400 with an error-codes body, and every event record carries only sitekeyHash, outcome and timestamp",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3602-edge-cloudflare-turnstile-server-verifier"
+  ]
+}

package/rcf/user-stories/us-9201.json

@@ -0,0 +1,27 @@
+{
+  "createdAt": "2026-09-07T19:56:36.233Z",
+  "updatedAt": "2026-09-07T19:56:39.716Z",
+  "asA": "shelf consumer whose Worker refuses cheap submit-without-token attempts at the earliest possible boundary",
+  "iWant": "the guard to reject every submit whose payload has no Cf-Turnstile-Response field with 400 before the downstream handler is entered",
+  "soThat": "downstream handlers never execute against a missing-token submit",
+  "usId": "US-9201",
+  "prdId": "PRD-001",
+  "reqId": "REQ-092",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-5 refuse-if-token-missing guard: a submit without Cf-Turnstile-Response rejects with 400 before any downstream logic",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-9201-1",
+      "description": "A source-tree scan of the pack fixture (guard-shape-scan) enumerates every elicited surface and asserts each carries a token-required guard registered at the route level. A live POST to /api/submit without a Cf-Turnstile-Response field is rejected with 400 and no downstream handler side-effect is observable. Refusal body carries a stable error-code, not the sitekey.",
+      "given": "the pack fixture running with every elicited surface registered",
+      "when": "a submit reaches the route without a Cf-Turnstile-Response value",
+      "then": "the guard rejects with 400 with an error-code body and no downstream handler runs",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3602-edge-cloudflare-turnstile-server-verifier"
+  ]
+}

package/rcf/user-stories/us-9301.json

@@ -0,0 +1,27 @@
+{
+  "createdAt": "2026-09-07T19:56:36.636Z",
+  "updatedAt": "2026-09-07T19:56:39.901Z",
+  "asA": "shelf consumer applying both security-auth-magic-link and edge-cloudflare-turnstile",
+  "iWant": "the magic-link mint surface to be gated by the Turnstile guard so a mint submit reads through the same token check as any other elicited surface",
+  "soThat": "magic-link mint requests are protected by the same human-check as any other public form on my project",
+  "usId": "US-9301",
+  "prdId": "PRD-001",
+  "reqId": "REQ-093",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-5 composition with security-auth-magic-link: the magic-link mint surface reads through the Turnstile guard",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-9301-1",
+      "description": "The blueprint contribution ADR-3601 declares the composition contract on the humanVerificationGate topic; the pack fixture ships a magic-link mint stub route (/api/magic-link) registered with the Turnstile guard. A source-tree read of the composition wire confirms the mint surface calls through the Turnstile guard before invoking the magic-link mint.",
+      "given": "the pack fixture with both blueprints applied and /api/magic-link registered with the token-required guard",
+      "when": "the composition contract is walked in the source tree",
+      "then": "the magic-link mint surface reads the Turnstile token check before invoking the mint",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3603-edge-cloudflare-turnstile-magic-link-hook"
+  ]
+}

package/rcf/user-stories/us-9302.json

@@ -0,0 +1,27 @@
+{
+  "createdAt": "2026-09-07T19:56:37.055Z",
+  "updatedAt": "2026-09-07T19:56:40.090Z",
+  "asA": "shelf consumer relying on the composition to gate magic-link mint attempts",
+  "iWant": "a magic-link mint POST that carries no Turnstile response, or a mint POST whose Turnstile response fails siteverify, to be refused with 400 before the mint fires",
+  "soThat": "no magic-link is minted for a submitter who did not complete a Turnstile challenge",
+  "usId": "US-9302",
+  "prdId": "PRD-001",
+  "reqId": "REQ-093",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-5 magic-link guard cross-cutting: a magic-link mint submit without a valid Turnstile token is refused with 400 before the mint fires",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-9302-1",
+      "description": "A live POST to /api/magic-link on the pack fixture without a Cf-Turnstile-Response field, and a POST carrying the always-fail response token, are both refused with 400 by the Turnstile guard and no magic-link is minted. The Playwright pack check AC-turnstile-magicLinkGuard drives this against the fixture with a real browser.",
+      "given": "the pack fixture running with both blueprints applied and a real Playwright browser driving the fixture",
+      "when": "a magic-link mint submit is issued without a Turnstile response, or with the always-fail response token",
+      "then": "the Turnstile guard refuses with 400 and no magic-link mint side-effect is observable",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3603-edge-cloudflare-turnstile-magic-link-hook"
+  ]
+}

package/rcf/user-stories/us-9401.json

@@ -0,0 +1,27 @@
+{
+  "createdAt": "2026-09-07T19:56:37.462Z",
+  "updatedAt": "2026-09-07T19:56:40.275Z",
+  "asA": "shelf consumer selecting a Turnstile widget mode for my project",
+  "iWant": "to elicit one of managed, non-interactive or invisible at apply time with managed as the recommendedDefault, and to see each mode render as Cloudflare documents",
+  "soThat": "my applied surface matches the operational profile the site needs (interactive challenge, always non-interactive, or invisible background check)",
+  "usId": "US-9401",
+  "prdId": "PRD-001",
+  "reqId": "REQ-094",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-5 widget mode elicit: managed, non-interactive and invisible each render per Cloudflare documented widget modes and the elicited default is managed",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-9401-1",
+      "description": "The blueprint elicit widget-mode contributes an enum with values managed, non-interactive and invisible; recommendedDefault managed. The pack fixture accepts ?mode=<managed|non-interactive|invisible> and mounts the widget with the pinned test sitekeys that match Cloudflare documented mode variants (sitekey 1x0000000000000000000000AA for interactive-pass, 1x0000000000000000000000BB for invisible-pass). Each mode renders the Turnstile iframe from challenges.cloudflare.com and no third-party origin.",
+      "given": "the pack fixture loaded with mode set to managed, non-interactive and invisible respectively",
+      "when": "each variant renders",
+      "then": "each renders the Turnstile widget from Cloudflare Turnstile origin only and no third-party script is loaded",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3601-edge-cloudflare-turnstile-widget-mount"
+  ]
+}

package/releases/releases.yaml

@@ -40,8 +40,28 @@
 # `npm install rcf-lite`.
 
 feedVersion: 1
-latest: "0.23.0"
+latest: "0.25.0"
 releases:
+  - version: "0.25.0"
+    date: "2026-09-08"
+    breaking: false
+    headlines:
+      - "rcf-lite 0.25.0 opens the Hetzner line with three blueprints in one round: a Hetzner Cloud server as the shipped Linux VM shape with the estate hardening baseline and a snapshot cadence, a docker-compose platform on top with healthchecks, secrets as file mounts and a first-class reverse-proxy artefact, and a Cloudflare Tunnel bridge that composes with Access when Zero Trust is applied and drops to public-hostname mode when it is not."
+      - "Every real-account probe across the round ships accountBoundSkipped pending the Hetzner and Cloudflare token vault ruling; the local probes carry the ship-time verdicts."
+      - "The follow-up Hetzner Object Storage adapter ships as a sequential PR under object-storage-s3 v1.1.0 after this release; the rcf-lite package version does not bump for it."
+    minAgentAction: null
+    notesUrl: "https://stravica.ai/docs/rcf/changelog/"
+
+  - version: "0.24.0"
+    date: "2026-09-08"
+    breaking: false
+    headlines:
+      - "rcf-lite 0.24.0 opens the Cloudflare line with six blueprints in one round: a Workers KV facade, cron triggers with an expression-router, durable objects covering strong-consistency and hibernatable WebSocket shapes, a Zero-Trust Access gate the admin console consumes, Turnstile with the pinned test keys running under a Playwright pack, and edge rate limiting with a committed manifest."
+      - "Each blueprint verifies against the real Cloudflare engine through node-only probes, and the admin console reads the Access-gate capability to switch its sign-in surface."
+      - "Also in this release: application-admin-console bumps 1.0.0 to 1.1.0 to consume the zeroTrustGate capability, and the authoring standard section 6a capability table gains seven new rows."
+    minAgentAction: null
+    notesUrl: "https://stravica.ai/docs/rcf/changelog/"
+
   - version: "0.23.0"
     date: "2026-09-07"
     breaking: false