Digital product / Production kit$59 CAD / one-time · v1.0.0

Ship the service. Skip the plumbing.

Name: Cloudflare Workers Production Kit
Brand: Sean Behan
Price: 59 CAD
Availability: InStock

A deployment-ready Astro and Cloudflare Workers reference starter with D1, R2, authentication, security, deployment and operating notes wired into one coherent system.

What ships

6 production modules

Worker foundation

Astro server rendering on Cloudflare Workers, strict TypeScript, local development and production configuration.

D1 data layer

Schema, migrations, typed queries and transaction patterns with fixtures that make local work repeatable.

R2 uploads

Validated uploads, object metadata, safe download responses and cleanup paths for abandoned files.

Authentication

Session handling, protected routes and authorization boundaries that stay explicit at the edge.

Abuse controls

Rate limiting, input validation, cache rules and security headers with notes on the tradeoffs.

Operations

CI deployment, environment separation, structured errors, monitoring hooks and a practical release runbook.

What’s inside

v1.0.0 · released August 28, 2026

Sanitized file tree

cloudflare-workers-production-kit/
├─ .github/workflows/   ci.yml · deploy.yml
├─ docs/                architecture · configuration · deployment · security · operations
├─ migrations/          0001_initial.sql
├─ public/              favicon.svg
├─ scripts/             release-check.mjs
├─ src/
│  ├─ layouts/          Base.astro
│  ├─ lib/              auth · config · crypto · db · github · http · validation
│  ├─ pages/            api/files · api/health · auth · dashboard.astro · index.astro
│  ├─ styles/           global.css
│  ├─ env.d.ts · middleware.ts
├─ test/                crypto.test.ts · validation.test.ts
├─ CHANGELOG.md · PRODUCT-LICENSE.md · THIRD-PARTY-NOTICES.md · README.md
└─ astro.config.mjs · package.json · tsconfig.json · vitest.config.ts · wrangler.jsonc

44 files in 16 directories; 92 KiB archive. Lockfiles elided above. SHA-256d8d55c83662bdb10eb5ba8c7443521ee8735882c4c3505dcb9e7ccdfc790a2f0.

Changelog — v1.0.0

Initial Astro and Cloudflare Worker reference application.
D1 users, hashed sessions and owner-scoped file metadata.
GitHub OAuth with state, PKCE and an optional numeric-ID allowlist.
Private R2 upload, download and delete flow.
Origin checks, security headers and rate-limit bindings.
CI, deployment workflow, tests, release scan and operations handbook.

Sample the handbook: trust boundaries

From docs/architecture.md in the archive:

GitHub numeric ID is durable identity. Login name is display metadata.
D1 is the authorization record. R2 metadata never grants access.
The R2 bucket stays private; downloads pass through the owner check in the Worker.
APP_ORIGIN is deployment configuration, never inferred from request headers.

Clone to deploy

One documented path

01
Clone
Start from a small working application rather than a directory of disconnected examples.
02
Configure
Set bindings and secrets from one documented inventory for local, preview and production.
03
Adapt
Remove sample features and keep the production boundaries your service needs.
04
Ship
Run checks, migrate D1 and deploy through the included GitHub Actions workflow.

One-time purchase

Own the foundation.

Get the complete release for $59 CAD. Buyers receive the source tree, written handbook, example application and one year of product updates.

Built for

Small teams / serious services

Good fit

Developers shipping an API, SaaS, content service or internal tool on Cloudflare who want to own straightforward source instead of adopting a platform-sized framework. Cloudflare experience still helps.

Not a fit

A visual page builder, managed backend, generic component library or promise that one architecture fits every workload.