Verification & release

Source contracts

npm run lint --prefix registry
npm run build --prefix registry
npm run sync:docs --prefix registry
npm test --prefix registry
npm run check:generated --prefix registry
npm run lint --prefix docs
npm run typecheck:site --prefix docs
npm run build:site --prefix docs

Registry tests verify dependency closure, documented examples, theme contracts and generated-source assumptions before browser work begins.

Generated equality

• Registry catalogs, both public endpoint copies, theme CSS and bootstrap are derived from source.
• check:generated requires byte-equivalent generated output and matching item lists.
• The CI clean-generation step rejects tracked diffs and unexpected untracked files.

Default CI

• Pushes to main, pull requests and manual runs without comprehensive enabled check registry lint/build/contracts, documentation lint/types/build and clean generation.
• Documentation interactions run in desktop-light and mobile-dark Chromium. Representative Vite and Next.js consumers run with consumer:verify --smoke.
• High or critical dependency audit findings block CI, including findings in development tools.

Full local and manual checks

• Run the full consumer checks and independent-item checks locally before broad releases, or manually run Verify with comprehensive enabled.
• The independent matrix derives every file-bearing item from the built catalog.
• Templates build in fresh Next.js projects; other items build independently in both Next.js and Vite.
• The manual workflow shards the independent matrix across three jobs and adds Firefox/WebKit consumer checks and the detail/material presentation suites.

Deployed-site smoke checks

• The Published registry workflow waits until build-info.json matches the triggering main commit.
• Only three Chromium smoke scenarios and three representative registry endpoints are checked against the deployed site. Full installation and browser matrices run locally or in the manual comprehensive workflow.
• Failure evidence is retained in CI artifacts; local browser evidence is written under docs/test-results.

Release boundaries

• A passing local or CI build does not claim shadcn directory approval or deployed-domain equivalence.
• Live-domain verification must match the exact deployed commit and public registry endpoints.
• License and attribution are a separate legal release gate; they are not inferred from repository ownership.