Cloudflare starter verification
Requirement: REQ-PRODUCT-CF-STARTER; related package, scoped-admin and immutable-history checks remain linked individually.
The starter creates a new local project. It does not install packages, log in, deploy, provision resources, choose a domain, generate credentials or modify existing directories. The host authorization stub denies access. Generated setup is local-only; inspection and export use scoped package stores.
Tests cover exclusive output creation, existing/symlink paths, malformed flags, packaged CLI/templates, denial before assets and object lookup, separate setup/export/source permissions, ignored browser permission headers, stable configured-site object selection, empty stores, site-matching release registration and retained private MDX sources. Source entry links are absent when the host store omits its private-source hook.
Verified locally on 18 October 2026:
npm run check: 276 package tests and 37 site tests passed, with catalog validation, website generation and the existing site's Worker dry run.- The npm packaging test installed both tarballs offline, invoked the installed CF CLI and verified that the generated authorization module denies by default.
node scripts/check-cf-starter-runtime.mjs: generated an isolated project, bundled its actual setup assets, passed that project's own Wrangler deployment dry run and ran it locally. The unchanged hook denied pages/assets. Disposable test-only host code then exercised private DO RPC, empty-to-recorded history, exact public/MDX archives, source denial without permission, separately granted source/setup/export access, ignored forged permission headers, GET/HEAD behavior and denied public writes.- The runtime check stopped and restarted its own Worker against the same SQLite state. Re-registering both releases returned
created: false, and the stored history remained readable. - Catalog: 67 requirements, 21 features, 57 sources and 67 verification scenarios, including 28 automated scenarios. Regional/legal review statuses remain independent.
The optional runtime script retains its disposable fixture under ignored local output and stops its own server. It is maintainer tooling; adopters choose their own CI/deployment checks. Its fictional role header and archive route are injected only into the disposable test copy and never generated by the shipped initializer.
Production routing, account selection, access policy, recording/identity integration, retention, restoration and removal remain host responsibilities. The deployment feature stays partial.