Reference Cloudflare SaaS

Generic reference implementation for the VibeCode QA Cloudflare SaaS stack.

This repository is intentionally not tied to a product domain. It exists to show how the standards work together in a runnable monorepo that can be copied, audited, and improved.

Official starters first

If you only need one platform slice, start with the official vendor path:

• React app from Scratch
• Vite getting started
• Cloudflare Pages React guide
• Cloudflare Workers templates
• Cloudflare D1 migrations
• MCP TypeScript SDK

This repo is not a replacement for vendor starters. It is a VCQA reference fixture for the composition: React SPA, Pages Functions, D1, Worker-hosted MCP, SDK, CLI, tenant manifests, deployment runbooks, CI gates, and a tracked VCQA report in one repo.

What it demonstrates

• React SPA with Vite, React Router, TypeScript, Vitest, and Playwright-ready structure.
• Cloudflare Pages Functions API deployed with the SPA.
• Cloudflare D1 schema and append-only migrations.
• Tenant-scoped Cloudflare deployment model with manifests and runbooks.
• Worker-hosted MCP server using the MCP TypeScript SDK's Web Standard Streamable HTTP transport, Zod-validated tool input, scoped permissions, and audit-ready responses.
• Private TypeScript SDK consumed by a Node CLI.
• GitHub Actions CI gates for build, typecheck, test, migration apply, and VCQA scanning.

Standards target

This repo is designed to satisfy:

Standard	Role
React SPA v1	Frontend app shape
Cloudflare Pages Fullstack v1	Same-origin SPA plus Pages Functions API
Cloudflare D1 App v1	D1 bindings, migrations, query safety, env isolation
Cloudflare Worker MCP Server v1	Worker-hosted remote MCP surface
Tenant-Deployed Cloudflare SaaS v1	Tenant resources, promotion, rollback, audit
Security v1	Cross-cutting security baseline

The standards are the source of truth. This repo is only a reference implementation.

Quickstart

corepack enable
pnpm install
pnpm typecheck
pnpm test
pnpm build

For local D1 development:

pnpm --filter @ref/app d1:local

For a VCQA report:

npx @vibecodeqa/cli --markdown > docs/vcqa-report.md

Tenant model

This template assumes one production D1 database per tenant and separate preview, staging, and production bindings. See:

• Standards map
• Tenant manifest example
• Provision tenant runbook
• Promote tenant runbook
• Rollback and restore runbook
• Incident response runbook

Production warning

This is a reference template. Before using it for a real customer, replace placeholder tenant IDs, Cloudflare account IDs, database IDs, domains, OAuth settings, access policy names, and secrets with your own managed infrastructure.