Skip to content

Cloudflare Pages Fullstack - Edition v1

Edition metadata

Targets: Cloudflare Pages Functions · static frontend · TypeScript · GitHub Actions Reviewed: 2026-07 · Next review due: 2027-07 Status: latest · Pin as: cloudflare-pages-fullstack@v1 Canonical URL: https://vibecodeqa.online/standards/cloudflare-pages-fullstack/v1/

This edition captures the gold standard for a static frontend co-deployed with Cloudflare Pages Functions. It focuses on the seam between frontend, edge API, Cloudflare bindings, auth middleware, and deployment.

Rule shape

Each rule has a stable ID (R-<AREA>-<n>), one checkable statement, the reason it exists, a vcqa signal that describes how a scanner or judge evaluates it, the evidence a reviewer must inspect, and primary references. Rules also follow the shared VCQA rule contract: severity, evidence, and accepted exceptions are explicit rather than reviewer judgement.

Rules state an obligation (must) plus the exception path that makes deviation reviewable. Where an earlier draft of this edition used should, the rule meaning is unchanged: the expectation is now carried by an explicit severity and an acceptedException record instead of reviewer interpretation.

Severity and evidence defaults

Rule group Default severity Required evidence
Archetype identity and the API seam (SHAPE, SEAM-1, SEAM-2) blocker when the deployed route graph cannot serve both halves; otherwise high Repo layout, Pages project config, _routes.json/_redirects, deployed-URL responses with status and content-type.
Authorization and secret boundary (AUTH, SEC) blocker when an unauthenticated request reaches a privileged binding or a secret is reachable from browser assets; otherwise high Function handlers and middleware, built assets, negative-auth smoke transcript.
Environment and bindings (ENV, BIND) blocker for shared preview/production binding IDs or secret-like client env; otherwise medium Wrangler config binding blocks, Env types, deploy workflow environment selection.
Contracts and validation (TYPE, VAL) high when unvalidated input reaches a binding or an authorization decision; otherwise medium Shared types/schemas, handler parse calls, tests over rejected input.
Deployment assembly and CI (DEPLOY, CI) blocker when the two halves can ship out of step; otherwise high Deploy workflow, wrangler pages deploy invocation, branch/environment selection, job ordering.
Smoke tests, evidence, and observability (TEST, OBS) high for missing seam or negative-auth assertions; evidence-only for missing retained transcripts, escalating to high when the missing artifact hides a SEAM/AUTH failure Smoke test source, CI logs, uploaded transcripts/traces with deployment URL, commit SHA, and timestamp.

Accepted exceptions use the shared acceptedException template: owner, scope, environment/tenant, reason, compensating controls, evidence, expiry/review date, and approval trail. An exception cannot override archetype identity: a repo that needs a long-running server is not a cloudflare-pages-fullstack with an exception.

The rubric

# Area Code What it governs
1 Project shape SHAPE repo layout, static frontend, Functions slice
2 Routing seams SEAM SPA fallback, /api/*, route collision avoidance
3 Auth and security AUTH / SEC authorization boundary, secret handling, safe errors
4 Environment and bindings ENV / BIND client env, Cloudflare bindings, preview/prod isolation
5 Typing and validation TYPE / VAL request/response contracts and runtime validation
6 Deployment and CI DEPLOY / CI build assembly, branch deployment, permissions
7 Testing and observability TEST / OBS preview smoke tests, logs, diagnostics

Non-negotiables

  • R-SEAM-1 - Pages Functions own the API namespace and must not be shadowed by SPA routes.
  • R-AUTH-1 - protected API reads and writes are authorized in Functions or middleware, not only in client code.
  • R-ENV-1 - client environment variables are public; secrets live in Cloudflare bindings or deployment secrets.
  • R-BIND-1 - preview, staging, and production bindings are explicitly separated.
  • R-DEPLOY-1 - static assets and Functions are assembled into one Pages deployment.

Reports and scans should cite this pinned edition URL: https://vibecodeqa.online/standards/cloudflare-pages-fullstack/v1/

Reference baseline