Verify the Source Candidate

Verify the Source Candidate

Prerequisites

Bun 1.4.0, Node.js 24 or later, access to the public npm registry, and an extracted source candidate. No private registry or CMS credentials are required.

Public import

The checks consume the package names and subpaths documented in the public export reference. No private SDK or credentials are required. A minimal runtime import is:

import { defineSite } from '@alneas/sitekit/config';
console.log(defineSite({ id: 'example', content: { snapshot: { siteId: 'example', revision: 1, posts: [], assets: [] } } }).id);

Step-by-Step Implementation

1. Install the locked dependencies

Run from the extracted project root:

bun install --frozen-lockfile --ignore-scripts --registry=https://registry.npmjs.org

2. Validate the source boundary and packages

bun run verify:public
bun run typecheck:all
bun run docs:check
bun run test:all
bun run build:all

3. Verify builds and isolated package installation

bun run test:site-build
bun run test:consumer

4. Pack artifacts for the quickstarts

From the candidate root:

bun pm pack --cwd packages/core --ignore-scripts --filename ../../alneas-sitekit-0.1.0.tgz
cd packages/cloudflare
bun pm pack --ignore-scripts --filename ../../alneas-sitekit-cloudflare-0.1.0.tgz
cd ../..

Expected result: two tarballs appear in the candidate root with exactly the names used by the quickstarts. Packing does not publish them or remove the publication guard.

Verification

The boundary check reports registered documentation and a closed publication gate. The tests cover the generic core and adapter. The build smoke test produces equivalent static HTML from inline, file and HTTP inputs, with verified image bytes. The consumer test packs both packages, checks their MIT license files, installs them into a temporary project and imports their public entry points, including the basic management screen, HTTP client, Studio contracts, metadata, the collection table and Cloudflare editing APIs. SQLite persistence is checked with the actual public schema. The optional table requires compatible React peers and the Appkit stylesheet; see public Studio integrations.

Troubleshooting / Common Pitfalls

• Dependency download failures: check public npm connectivity and Bun’s writable temporary/cache directories.
• Image mismatch or missing hash: correct the publication and image bytes together; do not disable verification.
• A private-file boundary failure: keep operator records, proprietary integrations and dependency archives outside the source candidate.
• Package publication fails intentionally: the MIT license permits reuse, while private: true and the publication script preserve the release approval gate.

Maintainer documentation checks

bun run docs:prepare wraps the canonical plain READMEs in metadata-bearing landing documents. bun run docs:check builds declarations, checks the explicit public manifest, validates feature imports against the selected package exports, checks JSDoc coverage, and typechecks guide/JSDoc examples as ESM with Astro-style bundler resolution. Stylesheet imports are validated against exports; bundling is checked separately by the consumer test.

The source candidate contains no documentation website or translation runtime. Run the downstream portal’s importer with --verify against this project’s manifest when its checkout is available; that read-only preflight is separate from actual ingestion and publication. Edit sources here, not generated portal pages.