reference
Sources
Dated primary documentation used to verify the course's AI, runtime, Git, framework, hosting, authentication, and database guidance.
Last checked: 2026-07-25
This is a maintenance register, not a substitute for the linked documentation. Product interfaces, supported versions, pricing, limits, and authentication flows change. Reopen the source before teaching or implementing a version-sensitive step.
OpenAI models, context, and API use
| Primary source | What was checked |
|---|---|
| Models | Current model catalog describes different capability, speed, price, context, tool, and reasoning profiles. The course avoids freezing those moving choices in lesson prose. |
| Compare models | Model choice and supported features are model-specific; current identifiers and limits belong in a dated implementation decision. |
| Model guidance | Model choice and reasoning effort are separate decisions; representative evaluations should determine the useful trade-off. |
| API authentication | API keys authenticate API calls, must be kept secret, and must not be exposed in browser or application client code. |
| API pricing | API usage is priced by current model and modality units; lessons link to current pricing rather than copying rates. |
These sources are examples from one provider. The course's general decision method also applies to other providers, but their credential classes, model names, prices, data handling, and controls must be checked in their own official documentation.
Runtime and package management
| Primary source | What was checked |
|---|---|
| Node.js download | Official installation source and currently supported releases. The project-declared runtime requirement remains authoritative. |
| Introduction to Node.js | Node.js is a JavaScript runtime used outside the browser. |
| npm package specification | package.json declares project metadata, scripts, and dependencies. |
| Bun installation | Current macOS and Windows installation and version-check routes. |
| Bun install | Install behaviour, lifecycle-script policy, frozen installs, and CI guidance. |
| Bun lockfile | The current text lockfile is bun.lock and should be committed for reproducible installs. |
Git and GitHub
| Primary source | What was checked |
|---|---|
| Git: About version control | Version control records changes over time and supports comparison and recovery. |
| Git: Getting a repository | A repository can be initialized locally or cloned. |
| Git: Recording changes | Tracked, untracked, modified, staged, and committed states; a commit records the staged snapshot. |
| Git downloads for macOS | Official macOS installation routes. |
| Git downloads for Windows | Official Git for Windows route. |
| GitHub authentication | Current account and Git-operation authentication guidance. |
| Create a repository | Repository ownership, creation, and visibility workflow. |
| Create a pull request | A pull request proposes changes from a branch for collaboration before merge. |
| Giving reviews | Review comments, requested changes, and approval happen against proposed changes. |
Web framework, hosting, authentication, and data
| Primary source | What was checked |
|---|---|
| Why Astro | Astro's content-oriented, server-first framework model and default approach to client JavaScript. |
| Astro installation | Current project-creation and local setup guidance. |
| Astro deployment | Current deployment routes and platform-specific guidance. |
| Next.js App Router | The app starter's file-system routing, layouts, navigation, and server/client component model. |
| Next.js project structure | Current App Router folder and file conventions. |
| Vercel Git deployments | Connected repositories produce preview deployments for proposed work and production deployments from the configured production branch. |
| Vercel deployment overview | Local, preview, and production environments and the evidence available in deployment logs. |
| Supabase Auth | Authentication identifies users; authorization controls access; Supabase can combine sessions with RLS. |
| Supabase Auth architecture | Client, gateway, auth service, and Postgres layers; protected views and RLS behaviour require deliberate configuration. |
| Supabase Google login | Current Google OAuth provider, callback, origin, and client configuration flow. |
| Supabase row-level security | RLS policy model for data accessed through applicable database roles and APIs. |
| Google OAuth web-server applications | Authorized origins, redirect URI matching, authorization flow, and server-side credential handling. |
Tested upstream app baseline
| Primary source | What was checked |
|---|---|
KRSHH/standard-saas-starter | Upstream repository, documentation, licence, and moving default branch. |
Tested commit e887b0c | Course audit baseline dated 2026-07-22 and reviewed on 2026-07-25. Exact dependency and runtime state comes from this commit. |
Maintenance rule
When a source changes:
- record the new check date;
- identify the lesson or template affected;
- update commands or claims only after a clean test;
- preserve the old tested commit or decision in history;
- rerun the course's relevant build, link, preflight, and project-path checks.
Do not write “latest” into a command or lesson unless the workflow deliberately accepts a moving dependency and explains how it will be rechecked.