rcf-lite 0.28.4 → 0.30.0

package/blueprints/edge-cloudflare-tunnel/contributions/user-stories/edge-cloudflare-tunnel-us-39103.json

@@ -17,7 +17,7 @@
       "disposition": "fixed",
       "ownerRef": {
         "tacId": "TAC-4002-edge-cloudflare-tunnel-manifest-schema",
-        "field": "interfaces.schema"
+        "field": "interfaces"
       },
       "given": "the canonical fixture manifest with the three required-shape invariants (uuid tunnel id, credentialsFile.secretRef reference, terminal catch-all)",
       "when": "manifest-schema-validate runs against the canonical fixture",
@@ -34,7 +34,7 @@
       "disposition": "fixed",
       "ownerRef": {
         "tacId": "TAC-4002-edge-cloudflare-tunnel-manifest-schema",
-        "field": "interfaces.schema"
+        "field": "interfaces"
       }
     },
     {
@@ -48,7 +48,7 @@
       "disposition": "fixed",
       "ownerRef": {
         "tacId": "TAC-4002-edge-cloudflare-tunnel-manifest-schema",
-        "field": "responsibilities.credentialsSecretRef"
+        "field": "responsibilities"
       }
     },
     {
@@ -62,7 +62,7 @@
       "disposition": "fixed",
       "ownerRef": {
         "tacId": "TAC-4002-edge-cloudflare-tunnel-manifest-schema",
-        "field": "interfaces.schema"
+        "field": "interfaces"
       }
     }
   ],

package/blueprints/edge-cloudflare-tunnel/contributions/user-stories/edge-cloudflare-tunnel-us-39104.json

@@ -17,7 +17,7 @@
       "disposition": "fixed",
       "ownerRef": {
         "tacId": "TAC-4002-edge-cloudflare-tunnel-manifest-schema",
-        "field": "interfaces.schema"
+        "field": "interfaces"
       },
       "vendorCitation": {
         "url": "https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/do-more-with-tunnels/local-management/configuration-file/",
@@ -38,7 +38,7 @@
       "disposition": "fixed",
       "ownerRef": {
         "tacId": "TAC-4002-edge-cloudflare-tunnel-manifest-schema",
-        "field": "interfaces.schema"
+        "field": "interfaces"
       },
       "vendorCitation": {
         "url": "https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/do-more-with-tunnels/local-management/configuration-file/",

package/blueprints/edge-cloudflare-tunnel/contributions/user-stories/edge-cloudflare-tunnel-us-39105.json

@@ -17,7 +17,7 @@
       "disposition": "fixed",
       "ownerRef": {
         "tacId": "TAC-4002-edge-cloudflare-tunnel-manifest-schema",
-        "field": "responsibilities.originPortRefusal"
+        "field": "responsibilities"
       },
       "given": "the fixture manifest with one ingress rule service URL bound to 0.0.0.0 or a host public interface (SIMULATE_ORIGIN_PORT_OPEN=true)",
       "when": "manifest-schema-validate runs against the mutated fixture",
@@ -34,7 +34,7 @@
       "disposition": "fixed",
       "ownerRef": {
         "tacId": "TAC-4002-edge-cloudflare-tunnel-manifest-schema",
-        "field": "responsibilities.originPortRefusal"
+        "field": "responsibilities"
       }
     }
   ],

package/blueprints/edge-cloudflare-tunnel/contributions/user-stories/edge-cloudflare-tunnel-us-39106.json

@@ -17,7 +17,7 @@
       "disposition": "fixed",
       "ownerRef": {
         "tacId": "TAC-4003-edge-cloudflare-tunnel-access-binding",
-        "field": "responsibilities.audAttach"
+        "field": "responsibilities"
       },
       "vendorCitation": {
         "url": "https://developers.cloudflare.com/cloudflare-one/applications/configure-apps/self-hosted-public-app/",
@@ -38,7 +38,7 @@
       "disposition": "template",
       "ownerRef": {
         "tacId": "TAC-4003-edge-cloudflare-tunnel-access-binding",
-        "field": "responsibilities.accessGated"
+        "field": "responsibilities"
       },
       "vendorCitation": {
         "url": "https://developers.cloudflare.com/cloudflare-one/applications/configure-apps/self-hosted-public-app/",
@@ -56,7 +56,7 @@
       "disposition": "template",
       "ownerRef": {
         "tacId": "TAC-4003-edge-cloudflare-tunnel-access-binding",
-        "field": "responsibilities.accessGated"
+        "field": "responsibilities"
       },
       "vendorCitation": {
         "url": "https://developers.cloudflare.com/cloudflare-one/applications/configure-apps/self-hosted-public-app/",
@@ -74,7 +74,7 @@
       "disposition": "template",
       "ownerRef": {
         "tacId": "TAC-4003-edge-cloudflare-tunnel-access-binding",
-        "field": "responsibilities.accessGated"
+        "field": "responsibilities"
       },
       "vendorCitation": {
         "url": "https://developers.cloudflare.com/cloudflare-one/applications/configure-apps/self-hosted-public-app/",
@@ -92,7 +92,7 @@
       "disposition": "template",
       "ownerRef": {
         "tacId": "TAC-4003-edge-cloudflare-tunnel-access-binding",
-        "field": "responsibilities.accessGated"
+        "field": "responsibilities"
       },
       "vendorCitation": {
         "url": "https://developers.cloudflare.com/cloudflare-one/applications/configure-apps/self-hosted-public-app/",

package/blueprints/edge-cloudflare-tunnel/contributions/user-stories/edge-cloudflare-tunnel-us-39107.json

@@ -17,7 +17,7 @@
       "disposition": "fixed",
       "ownerRef": {
         "tacId": "TAC-4003-edge-cloudflare-tunnel-access-binding",
-        "field": "responsibilities.audAttach"
+        "field": "responsibilities"
       },
       "given": "the gated fixture sidecar with one ingress rule missing the originRequest.access block (SIMULATE_AUD_DROP=true)",
       "when": "aud-presence-check runs on the mutated gated sidecar",
@@ -34,7 +34,7 @@
       "disposition": "fixed",
       "ownerRef": {
         "tacId": "TAC-4003-edge-cloudflare-tunnel-access-binding",
-        "field": "responsibilities.audAttach"
+        "field": "responsibilities"
       }
     }
   ],

package/blueprints/edge-cloudflare-tunnel/contributions/user-stories/edge-cloudflare-tunnel-us-39108.json

@@ -17,7 +17,7 @@
       "disposition": "fixed",
       "ownerRef": {
         "tacId": "TAC-4002-edge-cloudflare-tunnel-manifest-schema",
-        "field": "responsibilities.credentialsSecretRef"
+        "field": "responsibilities"
       }
     },
     {
@@ -31,7 +31,7 @@
       "disposition": "fixed",
       "ownerRef": {
         "tacId": "TAC-4002-edge-cloudflare-tunnel-manifest-schema",
-        "field": "responsibilities.credentialsDiscipline"
+        "field": "responsibilities"
       }
     },
     {
@@ -45,7 +45,7 @@
       "disposition": "fixed",
       "ownerRef": {
         "tacId": "TAC-4002-edge-cloudflare-tunnel-manifest-schema",
-        "field": "responsibilities.credentialsDiscipline"
+        "field": "responsibilities"
       }
     }
   ],

package/blueprints/edge-cloudflare-tunnel/contributions/user-stories/edge-cloudflare-tunnel-us-39109.json

@@ -20,7 +20,7 @@
       "disposition": "fixed",
       "ownerRef": {
         "tacId": "TAC-4004-edge-cloudflare-tunnel-zone-and-hostname-apply",
-        "field": "responsibilities.zoneResolve"
+        "field": "responsibilities"
       }
     },
     {
@@ -34,7 +34,7 @@
       "disposition": "fixed",
       "ownerRef": {
         "tacId": "TAC-4004-edge-cloudflare-tunnel-zone-and-hostname-apply",
-        "field": "responsibilities.zoneResolve"
+        "field": "responsibilities"
       }
     },
     {
@@ -48,7 +48,7 @@
       "disposition": "fixed",
       "ownerRef": {
         "tacId": "TAC-4004-edge-cloudflare-tunnel-zone-and-hostname-apply",
-        "field": "responsibilities.zoneResolve"
+        "field": "responsibilities"
       }
     },
     {
@@ -62,7 +62,7 @@
       "disposition": "fixed",
       "ownerRef": {
         "tacId": "TAC-4004-edge-cloudflare-tunnel-zone-and-hostname-apply",
-        "field": "responsibilities.audMandatoryWhenGated"
+        "field": "responsibilities"
       }
     }
   ],

package/blueprints/edge-cloudflare-tunnel/contributions/user-stories/edge-cloudflare-tunnel-us-39110.json

@@ -20,7 +20,7 @@
       "disposition": "template",
       "ownerRef": {
         "tacId": "TAC-4004-edge-cloudflare-tunnel-zone-and-hostname-apply",
-        "field": "responsibilities.hostnameTemplateExpand"
+        "field": "responsibilities"
       }
     },
     {
@@ -34,7 +34,7 @@
       "disposition": "fixed",
       "ownerRef": {
         "tacId": "TAC-4004-edge-cloudflare-tunnel-zone-and-hostname-apply",
-        "field": "responsibilities.hostnameTemplateExpand"
+        "field": "responsibilities"
       }
     },
     {
@@ -48,7 +48,7 @@
       "disposition": "fixed",
       "ownerRef": {
         "tacId": "TAC-4004-edge-cloudflare-tunnel-zone-and-hostname-apply",
-        "field": "responsibilities.hostnameTemplateExpand"
+        "field": "responsibilities"
       }
     }
   ],

package/blueprints/edge-cloudflare-turnstile/contributions/requirements/edge-cloudflare-turnstile-req-001.json

@@ -16,6 +16,6 @@
   "updatedAt": "2026-09-10T00:00:00.000Z",
   "deliveredBy": {
     "tacId": "TAC-3601-edge-cloudflare-turnstile-widget-mount",
-    "field": "interfaces.mountTurnstile"
+    "field": "interfaces[mountTurnstile]"
   }
 }

package/blueprints/edge-cloudflare-turnstile/contributions/requirements/edge-cloudflare-turnstile-req-002.json

@@ -16,6 +16,6 @@
   "updatedAt": "2026-09-09T00:00:00.000Z",
   "deliveredBy": {
     "tacId": "TAC-3602-edge-cloudflare-turnstile-server-verifier",
-    "field": "interfaces.createTurnstileVerifier"
+    "field": "interfaces[createTurnstileVerifier]"
   }
 }

package/blueprints/edge-cloudflare-turnstile/contributions/requirements/edge-cloudflare-turnstile-req-003.json

@@ -16,6 +16,6 @@
   "updatedAt": "2026-09-09T00:00:00.000Z",
   "deliveredBy": {
     "tacId": "TAC-3602-edge-cloudflare-turnstile-server-verifier",
-    "field": "interfaces.verifier.guard"
+    "field": "interfaces[verifier.guard]"
   }
 }

package/blueprints/edge-cloudflare-turnstile/contributions/requirements/edge-cloudflare-turnstile-req-004.json

@@ -16,6 +16,6 @@
   "updatedAt": "2026-09-09T00:00:00.000Z",
   "deliveredBy": {
     "tacId": "TAC-3603-edge-cloudflare-turnstile-magic-link-hook",
-    "field": "responsibilities.guardMint"
+    "field": "responsibilities"
   }
 }

package/blueprints/edge-cloudflare-turnstile/contributions/requirements/edge-cloudflare-turnstile-req-005.json

@@ -16,6 +16,6 @@
   "updatedAt": "2026-09-09T00:00:00.000Z",
   "deliveredBy": {
     "adrId": "ADR-3602-edge-cloudflare-turnstile-widget-mode",
-    "field": "decision.widgetModeEnum"
+    "field": "decision"
   }
 }

package/blueprints/edge-cloudflare-turnstile/contributions/tacs/tac-3601-edge-cloudflare-turnstile-widget-mount.json

@@ -16,8 +16,9 @@
   "interfaces": [
     {
       "name": "mountTurnstile",
-      "kind": "function",
-      "summary": "Mount the Turnstile widget onto a target element with the elicited sitekey and widget mode."
+      "kind": "other",
+      "summary": "Mount the Turnstile widget onto a target element with the elicited sitekey and widget mode.",
+      "description": "(legacy kind: function)"
     }
   ],
   "dependencies": [],

package/blueprints/edge-cloudflare-turnstile/contributions/tacs/tac-3602-edge-cloudflare-turnstile-server-verifier.json

@@ -16,18 +16,21 @@
   "interfaces": [
     {
       "name": "createTurnstileVerifier",
-      "kind": "factory",
-      "summary": "Turnstile server-side verifier over env.TURNSTILE_SECRET."
+      "kind": "other",
+      "summary": "Turnstile server-side verifier over env.TURNSTILE_SECRET.",
+      "description": "(legacy kind: factory)"
     },
     {
       "name": "verifier.verify",
-      "kind": "method",
-      "summary": "POST {secret, response} to siteverify; returns {success, errorCodes}."
+      "kind": "other",
+      "summary": "POST {secret, response} to siteverify; returns {success, errorCodes}.",
+      "description": "(legacy kind: method)"
     },
     {
       "name": "verifier.guard",
-      "kind": "method",
-      "summary": "Middleware that reads cf-turnstile-response and rejects missing-token submits with 400."
+      "kind": "other",
+      "summary": "Middleware that reads cf-turnstile-response and rejects missing-token submits with 400.",
+      "description": "(legacy kind: method)"
     }
   ],
   "dependencies": [],

package/blueprints/edge-cloudflare-turnstile/contributions/tacs/tac-3603-edge-cloudflare-turnstile-magic-link-hook.json

@@ -15,8 +15,9 @@
   "interfaces": [
     {
       "name": "composeWithMagicLink",
-      "kind": "function",
-      "summary": "Register the magic-link mint route under the Turnstile guard."
+      "kind": "other",
+      "summary": "Register the magic-link mint route under the Turnstile guard.",
+      "description": "(legacy kind: function)"
     }
   ],
   "dependencies": [],

package/blueprints/edge-cloudflare-turnstile/contributions/user-stories/edge-cloudflare-turnstile-us-35101.json

@@ -20,7 +20,7 @@
       "disposition": "fixed",
       "ownerRef": {
         "tacId": "TAC-3601-edge-cloudflare-turnstile-widget-mount",
-        "field": "responsibilities.tokenFieldPopulate"
+        "field": "responsibilities"
       },
       "vendorCitation": {
         "url": "https://developers.cloudflare.com/turnstile/get-started/client-side-rendering/",
@@ -38,7 +38,7 @@
       "disposition": "fixed",
       "ownerRef": {
         "tacId": "TAC-3601-edge-cloudflare-turnstile-widget-mount",
-        "field": "responsibilities.tokenFieldPopulate"
+        "field": "responsibilities"
       },
       "vendorCitation": {
         "url": "https://developers.cloudflare.com/turnstile/troubleshooting/testing/",
@@ -56,7 +56,7 @@
       "disposition": "fixed",
       "ownerRef": {
         "tacId": "TAC-3601-edge-cloudflare-turnstile-widget-mount",
-        "field": "interfaces.mountTurnstile"
+        "field": "interfaces[mountTurnstile]"
       }
     }
   ],

package/blueprints/edge-cloudflare-turnstile/contributions/user-stories/edge-cloudflare-turnstile-us-35102.json

@@ -20,7 +20,7 @@
       "disposition": "fixed",
       "ownerRef": {
         "tacId": "TAC-3602-edge-cloudflare-turnstile-server-verifier",
-        "field": "interfaces.verifier.verify"
+        "field": "interfaces[verifier.verify]"
       },
       "vendorCitation": {
         "url": "https://developers.cloudflare.com/turnstile/troubleshooting/testing/",
@@ -38,7 +38,7 @@
       "disposition": "fixed",
       "ownerRef": {
         "tacId": "TAC-3601-edge-cloudflare-turnstile-widget-mount",
-        "field": "interfaces.mountTurnstile"
+        "field": "interfaces[mountTurnstile]"
       }
     },
     {
@@ -52,7 +52,7 @@
       "disposition": "fixed",
       "ownerRef": {
         "tacId": "TAC-3602-edge-cloudflare-turnstile-server-verifier",
-        "field": "interfaces.createTurnstileVerifier"
+        "field": "interfaces[createTurnstileVerifier]"
       }
     },
     {
@@ -66,7 +66,7 @@
       "disposition": "fixed",
       "ownerRef": {
         "tacId": "TAC-3602-edge-cloudflare-turnstile-server-verifier",
-        "field": "interfaces.createTurnstileVerifier"
+        "field": "interfaces[createTurnstileVerifier]"
       }
     }
   ],

package/blueprints/edge-cloudflare-turnstile/contributions/user-stories/edge-cloudflare-turnstile-us-35103.json

@@ -20,7 +20,7 @@
       "disposition": "fixed",
       "ownerRef": {
         "tacId": "TAC-3602-edge-cloudflare-turnstile-server-verifier",
-        "field": "interfaces.verifier.verify"
+        "field": "interfaces[verifier.verify]"
       },
       "vendorCitation": {
         "url": "https://developers.cloudflare.com/turnstile/troubleshooting/testing/",
@@ -38,7 +38,7 @@
       "disposition": "fixed",
       "ownerRef": {
         "tacId": "TAC-3602-edge-cloudflare-turnstile-server-verifier",
-        "field": "interfaces.verifier.verify"
+        "field": "interfaces[verifier.verify]"
       }
     },
     {
@@ -52,7 +52,7 @@
       "disposition": "fixed",
       "ownerRef": {
         "tacId": "TAC-3602-edge-cloudflare-turnstile-server-verifier",
-        "field": "interfaces.verifier.verify"
+        "field": "interfaces[verifier.verify]"
       }
     },
     {
@@ -66,7 +66,7 @@
       "disposition": "fixed",
       "ownerRef": {
         "tacId": "TAC-3602-edge-cloudflare-turnstile-server-verifier",
-        "field": "interfaces.verifier.verify"
+        "field": "interfaces[verifier.verify]"
       }
     },
     {
@@ -80,7 +80,7 @@
       "disposition": "fixed",
       "ownerRef": {
         "tacId": "TAC-3602-edge-cloudflare-turnstile-server-verifier",
-        "field": "interfaces.verifier.verify"
+        "field": "interfaces[verifier.verify]"
       }
     },
     {
@@ -94,7 +94,7 @@
       "disposition": "fixed",
       "ownerRef": {
         "tacId": "TAC-3602-edge-cloudflare-turnstile-server-verifier",
-        "field": "interfaces.verifier.verify"
+        "field": "interfaces[verifier.verify]"
       }
     }
   ],

package/blueprints/edge-cloudflare-turnstile/contributions/user-stories/edge-cloudflare-turnstile-us-35104.json

@@ -20,7 +20,7 @@
       "disposition": "fixed",
       "ownerRef": {
         "tacId": "TAC-3602-edge-cloudflare-turnstile-server-verifier",
-        "field": "interfaces.verifier.guard"
+        "field": "interfaces[verifier.guard]"
       }
     },
     {
@@ -34,7 +34,7 @@
       "disposition": "fixed",
       "ownerRef": {
         "tacId": "TAC-3602-edge-cloudflare-turnstile-server-verifier",
-        "field": "interfaces.verifier.guard"
+        "field": "interfaces[verifier.guard]"
       },
       "vendorCitation": {
         "url": "https://developers.cloudflare.com/turnstile/get-started/client-side-rendering/",

package/blueprints/edge-cloudflare-turnstile/contributions/user-stories/edge-cloudflare-turnstile-us-35105.json

@@ -30,7 +30,7 @@
       "disposition": "fixed",
       "ownerRef": {
         "tacId": "TAC-3603-edge-cloudflare-turnstile-magic-link-hook",
-        "field": "responsibilities.guardMint"
+        "field": "responsibilities"
       },
       "vendorCitation": {
         "url": "https://developers.cloudflare.com/turnstile/get-started/server-side-validation/",

package/blueprints/email-smtp-resend/contributions/requirements/email-smtp-resend-req-001.json

@@ -5,7 +5,7 @@
   "description": "The Resend send adapter exposes the send interface named by the magic-link blueprint's TAC-504-security-auth-magic-link-email-delivery-adapter, matching the signature owned on TAC-401-email-smtp-resend-send-adapter.interfaces.send, and resolves the fixed outcome shape declared on that same owner on every call. No other method is added to the auth-facing surface; provider status codes and provider message ids are normalised into the declared outcome fields inside the adapter. A project composing this blueprint alongside the magic-link blueprint wires the adapter reference into the auth routes at composition time and calls the adapter send method directly.",
   "deliveredBy": {
     "tacId": "TAC-401-email-smtp-resend-send-adapter",
-    "field": "interfaces.send"
+    "field": "interfaces[send]"
   },
   "category": "functional",
   "domain": "email",

package/blueprints/email-smtp-resend/contributions/requirements/email-smtp-resend-req-002.json

@@ -5,7 +5,7 @@
   "description": "The adapter dials Resend's SMTP submission endpoint (host and port declared as configuration references, not literal in-code strings) and authenticates with an SMTP username and an SMTP password sourced from a Secrets Manager slice. The from-address on every outgoing message is a project-configured verified sender address, also sourced from configuration rather than a literal. Three configuration references are named by the adapter: `RESEND_SMTP_USER`, `RESEND_SMTP_PASSWORD`, and `RESEND_FROM_ADDRESS`. The names are references only; the values live in the vendor the project's Secrets Manager resolves against. No SMTP credential, no signing secret, and no real sender domain is ever committed to the repo or embedded in the adapter's code paths.",
   "deliveredBy": {
     "tacId": "TAC-401-email-smtp-resend-send-adapter",
-    "field": "interfaces.secretResolver"
+    "field": "interfaces[secretResolver]"
   },
   "category": "functional",
   "domain": "email",

package/blueprints/email-smtp-resend/contributions/requirements/email-smtp-resend-req-003.json

@@ -5,7 +5,7 @@
   "description": "The adapter enumerates four provider-side failure classes and maps each to a stable error code on the `error` field of the send-contract return shape, with `ok: false` and the provider's own status code on `providerStatus` when the provider surfaced one. The classes are: rate-limit refusal (`RESEND_RATE_LIMITED`), unverified sender domain or address (`RESEND_SENDER_UNVERIFIED`), invalid or malformed recipient input the provider rejected before dispatch (`RESEND_RECIPIENT_REJECTED`), and generic transport error covering network faults and the provider's 5xx range (`RESEND_TRANSPORT_ERROR`). The error string carries the class code and a short structured reason; the recipient address, the message subject, and the message body never appear on the returned error string, on any log line the adapter writes, or on any exception the adapter throws.",
   "deliveredBy": {
     "tacId": "TAC-401-email-smtp-resend-send-adapter",
-    "field": "interfaces.send"
+    "field": "interfaces[send]"
   },
   "category": "functional",
   "domain": "email",

package/blueprints/email-smtp-resend/contributions/requirements/email-smtp-resend-req-004.json

@@ -5,7 +5,7 @@
   "description": "On a `RESEND_TRANSPORT_ERROR` or a `RESEND_RATE_LIMITED` return, the adapter retries up to a bounded budget (default 2 retries, project-configurable via a numeric configuration reference; total attempts including the first are therefore at most 3) with exponential backoff and full jitter (base 250ms, cap 8000ms). On `RESEND_SENDER_UNVERIFIED` and `RESEND_RECIPIENT_REJECTED` the adapter does not retry: the provider classified the request as terminally invalid and looping wastes budget and risks a rate-limit escalation. After exhausting the retry budget the adapter returns `{ ok: false, ... }` with the last-observed provider status and the class code that caused the exhaustion; the caller sees one adapter return, not a retry storm.",
   "deliveredBy": {
     "tacId": "TAC-401-email-smtp-resend-send-adapter",
-    "field": "interfaces.retryClock"
+    "field": "interfaces[retryClock]"
   },
   "category": "functional",
   "domain": "email",

package/blueprints/email-smtp-resend/contributions/requirements/email-smtp-resend-req-005.json

@@ -5,7 +5,7 @@
   "description": "The project exposes one HTTP route the Resend webhook posts delivery events to. The webhook verifier reads the incoming request's signature header (name declared as a configuration reference), reads the timestamp header (name declared as a configuration reference), and computes the expected signature using the webhook signing secret sourced from configuration (`RESEND_WEBHOOK_SIGNING_SECRET` placeholder reference). The verifier compares the computed signature against the header using a constant-time comparison. On mismatch the verifier returns HTTP 401 with an empty body and emits a structured `webhookVerificationFailed` audit event; the delivery event is not delivered to any downstream handler. The signing secret never appears on any log line, error string, or exception message. The header names, the signing algorithm identifier, and the timestamp-tolerance window are configuration references, not literals baked into the verifier.",
   "deliveredBy": {
     "tacId": "TAC-402-email-smtp-resend-webhook-verifier",
-    "field": "interfaces.verify"
+    "field": "interfaces[verify]"
   },
   "category": "functional",
   "domain": "email",

package/blueprints/email-smtp-resend/contributions/requirements/email-smtp-resend-req-006.json

@@ -5,7 +5,7 @@
   "description": "The verifier reads the webhook timestamp header and refuses any request whose timestamp is older than the configured tolerance window (default 300 seconds, project-configurable via a numeric configuration reference); a refused request returns HTTP 401 with an empty body and emits a `webhookReplayStale` audit event. On a verification-passing request, the verifier extracts the provider's delivery event id from the payload and consults a bounded event-id store (a stateful component the project realises: an in-memory LRU sized to the tolerance window's expected event volume, or a persisted store with a matching TTL); an event id that already appears in the store is refused with HTTP 200 (idempotent replay acknowledged, no downstream side effect), and emits a `webhookReplayDuplicate` audit event. New event ids are recorded in the store with an expiry equal to the tolerance window.",
   "deliveredBy": {
     "tacId": "TAC-402-email-smtp-resend-webhook-verifier",
-    "field": "interfaces.eventIdStore"
+    "field": "interfaces[eventIdStore]"
   },
   "category": "functional",
   "domain": "email",

package/blueprints/email-smtp-resend/contributions/tacs/tac-401-email-smtp-resend-send-adapter.json

@@ -21,23 +21,23 @@
   "interfaces": [
     {
       "name": "send",
-      "kind": "async-method",
-      "description": "send({ to, subject, textBody, htmlBody }) -> Promise<{ ok, providerStatus, providerMessageId, error }>; the sole auth-facing surface, shape-compatible with TAC-504-security-auth-magic-link-email-delivery-adapter."
+      "kind": "other",
+      "description": "send({ to, subject, textBody, htmlBody }) -> Promise<{ ok, providerStatus, providerMessageId, error }>; the sole auth-facing surface, shape-compatible with TAC-504-security-auth-magic-link-email-delivery-adapter. (legacy kind: async-method)"
     },
     {
       "name": "smtpClient",
-      "kind": "read-write-api",
-      "description": "Project-supplied SMTP client library binding the adapter dials the Resend SMTP endpoint through; injected at boot, imported by no other module of the application."
+      "kind": "other",
+      "description": "Project-supplied SMTP client library binding the adapter dials the Resend SMTP endpoint through; injected at boot, imported by no other module of the application. (legacy kind: read-write-api)"
     },
     {
       "name": "secretResolver",
-      "kind": "read-api",
-      "description": "Project-supplied resolver returning the value for a configured reference name; the adapter calls it at boot for `RESEND_SMTP_USER`, `RESEND_SMTP_PASSWORD`, and `RESEND_FROM_ADDRESS`."
+      "kind": "other",
+      "description": "Project-supplied resolver returning the value for a configured reference name; the adapter calls it at boot for `RESEND_SMTP_USER`, `RESEND_SMTP_PASSWORD`, and `RESEND_FROM_ADDRESS`. (legacy kind: read-api)"
     },
     {
       "name": "retryClock",
-      "kind": "callback",
-      "description": "Project-supplied clock and jitter source the retry loop consults; a real clock in production, a test double in unit tests. Injected at boot; deterministic under test."
+      "kind": "other",
+      "description": "Project-supplied clock and jitter source the retry loop consults; a real clock in production, a test double in unit tests. Injected at boot; deterministic under test. (legacy kind: callback)"
     }
   ],
   "dependencies": [

package/blueprints/email-smtp-resend/contributions/tacs/tac-402-email-smtp-resend-webhook-verifier.json

@@ -18,28 +18,28 @@
   "interfaces": [
     {
       "name": "verify",
-      "kind": "async-method",
-      "description": "verify({ headers, rawBody }) -> Promise<{ ok, status, event, refusal }>; returns `ok: true` with the parsed event on a passing request, `ok: false` with the HTTP status and a refusal class on any refused request."
+      "kind": "other",
+      "description": "verify({ headers, rawBody }) -> Promise<{ ok, status, event, refusal }>; returns `ok: true` with the parsed event on a passing request, `ok: false` with the HTTP status and a refusal class on any refused request. (legacy kind: async-method)"
     },
     {
       "name": "eventIdStore",
-      "kind": "read-write-api",
-      "description": "Project-supplied bounded store implementing `putIfAbsentWithExpiry(id, ttlSeconds) -> Promise<{ inserted }>`; returns `inserted: false` for a duplicate id inside the window and `inserted: true` for a fresh id."
+      "kind": "other",
+      "description": "Project-supplied bounded store implementing `putIfAbsentWithExpiry(id, ttlSeconds) -> Promise<{ inserted }>`; returns `inserted: false` for a duplicate id inside the window and `inserted: true` for a fresh id. (legacy kind: read-write-api)"
     },
     {
       "name": "auditSink",
-      "kind": "callback",
-      "description": "Structured-event sink invoked with `{ event, at, principal }` for `webhookVerificationFailed`, `webhookReplayStale`, and `webhookReplayDuplicate`; never invoked with the signing secret."
+      "kind": "other",
+      "description": "Structured-event sink invoked with `{ event, at, principal }` for `webhookVerificationFailed`, `webhookReplayStale`, and `webhookReplayDuplicate`; never invoked with the signing secret. (legacy kind: callback)"
     },
     {
       "name": "verifierClock",
-      "kind": "read-api",
-      "description": "Project-supplied clock the tolerance check consults; a real clock in production, a test double in unit tests. Injected at boot; deterministic under test."
+      "kind": "other",
+      "description": "Project-supplied clock the tolerance check consults; a real clock in production, a test double in unit tests. Injected at boot; deterministic under test. (legacy kind: read-api)"
     },
     {
       "name": "secretResolver",
-      "kind": "read-api",
-      "description": "Project-supplied secret-reference resolver. The verifier reads the webhook signing secret (`RESEND_WEBHOOK_SIGNING_SECRET`), the signature header name, the timestamp header name, the signing algorithm identifier, and the tolerance window through it at boot; carries no literal for the signing secret in verifier source (AC-4106-3). The resolver shape matches the resolver TAC-401 consumes for the SMTP secrets, so a project realises one resolver for both TACs."
+      "kind": "other",
+      "description": "Project-supplied secret-reference resolver. The verifier reads the webhook signing secret (`RESEND_WEBHOOK_SIGNING_SECRET`), the signature header name, the timestamp header name, the signing algorithm identifier, and the tolerance window through it at boot; carries no literal for the signing secret in verifier source (AC-4106-3). The resolver shape matches the resolver TAC-401 consumes for the SMTP secrets, so a project realises one resolver for both TACs. (legacy kind: read-api)"
     }
   ],
   "dependencies": [

package/blueprints/email-smtp-resend/contributions/user-stories/email-smtp-resend-us-4101.json

@@ -30,7 +30,7 @@
       "disposition": "fixed",
       "ownerRef": {
         "tacId": "TAC-401-email-smtp-resend-send-adapter",
-        "field": "interfaces.send"
+        "field": "interfaces[send]"
       }
     },
     {