>Would love to know if this is in contract/writing somewhere as part of the acquisition.

Cloudflare would be insane to allow that provision in the contract or acquisition documents.

So I would take that promise as "will stay open source, blah blah blah, for now...."

Dropbox did it for Zulip.

It entirely depends on how much the seller cared to ensure continuity. It’s not like VoidZero didn’t have plenty of leverage; they weren’t a dying open source project.

Dropbox spun out Zulip because it was a failed project they were going to shut down.

This is completely different?

Dropbox never had any intention of running Zulip. But the team wanted Zulip to continue existing, so they worked that into the agreement with Dropbox.

That is my understanding.

What would they benefit from taking it closed source? And how would that even work for a JavaScript toolchain?

It's natural to be sceptical. They're investing a huge amount of money and claiming that nothing will change. I.e.: that they seek nothing in return.

Not really. The claim is that nothing will change regarding the OSS projects.