Does Wavesteam deliver source code?
Yes. Wavesteam normally delivers the project-specific source and the material needed for a reproducible build. The exact scope belongs in the contract. Open-source libraries, commercial SDKs, and pre-existing reusable components remain subject to their own licences, so receiving source does not create unlimited sublicensing rights over everything in the repository.
A transferable delivery is not a zip sent at the end. At minimum, the client should receive a manageable Git repository, agreed branches and release tags, frontend, backend and mini-program code where applicable, dependency lockfiles, database migrations, API definitions, deployment instructions, editable design files, and an inventory of third-party services. Environment-variable names and instructions are documented, while production secret values move through a client-controlled secret store or secure channel rather than source control.
When agreeing deliverables, handover, and ownership boundaries, also compare How should documentation and handover be specified so source code is not the only deliverable?; the linked guidance adds context that should be considered in the same decision.
Three delivery models
| Model | What the client receives | Traceability | Takeover risk | Assessment |
|---|---|---|---|---|
| Source zip only | Snapshot from one point in time | No commit or release history | Missing configuration and scripts may prevent a build | Not suitable as formal acceptance |
| Repository plus documentation | Source, history, tags, documents, and artifact inventory | Versions and changes are traceable | Still requires a clean-environment build test | Minimum acceptable delivery |
| Continuous delivery into a client repository | Work happens in client-controlled repositories and pipelines | Progress is visible at each milestone | Accounts and permissions need early setup | Preferred for enterprise work |
The asset boundary must be explicit. Copyright ownership or licence to client-specific code, pages, APIs, and documents follows the contract. MIT, Apache, and other open-source code retains the original licence even when bundled. Commercial map, payment, or notification SDKs may restrict the contracting entity, volume, and distribution. Wavesteam recommends maintaining a software bill of materials from initiation with component, version, source, licence, and commercial expiry; SPDX identifiers provide a consistent naming scheme.
API documentation must match the running version and be testable by both people and tools. An OpenAPI definition is more useful than an obsolete screenshot. Database delivery includes schema migrations, required initialization notes, backup, and recovery. Design delivery states whether fonts, images, and other material have transferable or commercial rights. A sanitized dataset is sufficient for acceptance; copying unnecessary personal data does not make a delivery more complete.
Prove the handover independently
The most effective acceptance test asks the client team to build, deploy, restore data, roll back a release, and rotate secrets in a clean environment. Evidence includes build logs, version, artifact checksum, recovery result, and closure of discovered gaps. File count and an archive that opens do not prove maintainability. Private packages require client repository access, and any supplier-dependent service needs an exit or replacement route.
The contract annex lists each deliverable, format, location, date, acceptance method, and remediation period. Requests for complete commit history, security scans, or copyright-registration material should be identified before pricing because repository cleanup, licence review, and application preparation require work.
Wavesteam's preferred model is milestone-based continuous synchronization rather than handing over a single key at final payment. Our Transparent Delivery Standard describes the wider source, data, account, and deployment principles.