Direct-upload URLs, one media record whatever the backend, and AI enrichment that runs as a Workflow because captioning is slow and fails.
One logger seam, two adapters, and every record carrying the build that produced it — so the first question you ask at 2am has an answer in the dashboard.
Sign-in that treats a phone and a browser as the same problem, refresh rotation that survives a race, and a replayed token that takes its whole family down with it.
A queryable audit trail in your own D1, written by capabilities that never import it — and by the CLI, attributed to the actual person holding the token.
Transactional and lifecycle email as durable, tracked jobs — with a suppression list you never wire up and can still read like any other table.
Turnstile is the smallest thing in the kit: no state, no migrations, no middleware you did not ask for. What it demonstrates is how capabilities cooperate without importing each other.
Encrypted secrets with a master key that never leaves your Worker — and a rotation ordered around the one outcome no retry can repair.
Fifteen Cloudflare resource kinds, provisioned per environment — and the reaper, because eight orphaned secrets sat on a real account with nothing able to reclaim them.