开源的用户管理解决方案,自带前端组件和管理后台。
Go to file
BilalG1 2a67053758
Some checks failed
DB migration compat / Check if migrations changed (push) Has been cancelled
DB migration compat / Back-compat — Current branch migrations with ${{ needs.check-migrations-changed.outputs.base_branch }} branch code (push) Has been cancelled
DB migration compat / Forward-compat — Current branch code with ${{ needs.check-migrations-changed.outputs.base_branch }} branch migrations (push) Has been cancelled
DB migration compat / No migration changes (skipped) (push) Has been cancelled
Fix Elysia production compatibility (#1757)
## Summary

- use Vercel's native Elysia framework support with `src/index.ts` as
the deployment entrypoint
- remove the manual `api/` entrypoints and all `vercel.json` rewrites
- continue loading the prebuilt `dist/vercel.mjs` bundle so the
backend's existing tsdown bundling remains unchanged
- keep API-version migration paths internal instead of exposing them
through `x-middleware-rewrite`
- add integration coverage for the migration branch's global Elysia
error boundary and sanitized 500 response
- inherit the Vercel project's 800-second maximum duration for every
backend route

## Why

The staging deployment timed out every request at the configured
60-second function limit. The serverless entrypoint returned a Web
`Response` from a default-exported function, but Vercel interpreted that
export shape as the legacy Node `(request, response)` handler contract
and waited for the unused response object to be ended.

The Elysia migration also exposed the internal API-version migration
destination through `x-middleware-rewrite`. That header was internal
Next.js routing state and was not exposed by the previous production
transport.

Consolidating the backend into one function initially hardcoded a
60-second duration. That was especially significant for the external DB
sync poller and sequencer, whose normal work loops allow up to 180
seconds. The Vercel project is already configured with an 800-second
maximum, so the backend now inherits that setting directly instead of
maintaining route-specific wrapper files.

Vercel's native Elysia builder recognizes `src/index.ts` when it
contains a direct `elysia` import, and automatically routes requests to
that application. This makes the manual catch-all rewrite and root
`api/` directory unnecessary.

## Production behavior

- Vercel requests are routed directly to the Elysia application through
the native Elysia builder.
- API migration routes retain their public URL without revealing
internal migration paths.
- Uncaught middleware or dispatch errors are captured by the global
boundary and return a generic `500 Internal Server Error` with the
global security headers.
- All external DB sync endpoints—`fusebox`, `poller`, `sequencer`,
`status`, and `sync-engine`—inherit the project's 800-second function
duration.
- GitHub config `apply`, `commit`, and `cancel` also inherit 800
seconds. This raises the previous 120-second `commit` and 60-second
`cancel` maximums; normal successful behavior is unchanged, but a stuck
invocation can run and be billed for longer before Vercel terminates it.

## Tradeoffs

The function-duration policy is now controlled in one place—the Vercel
project—rather than split between dashboard configuration and route
wrappers. This is simpler and ensures long-running backend routes have
enough time, but changing the project setting affects every endpoint.

The native entrypoint remains a thin wrapper around the tsdown-generated
bundle rather than asking Vercel to bundle the backend source graph.
This preserves the existing alias and dependency bundling behavior while
still using Vercel's native Elysia routing.

The remaining lower-priority Elysia migration compatibility items are
intentionally deferred to follow-up PRs.

## Validation

- `pnpm test run apps/backend/src/server/app.ts` — 2 tests passed
- focused TypeScript check for the native entrypoint and bundle
declaration
- the installed Vercel Elysia builder identifies `src/index.ts` as the
application entrypoint
- `pnpm test run
apps/e2e/tests/backend/endpoints/api/migration-tests.test.ts` against
the running local backend — 13 tests passed
- live browser and raw HTTP checks confirmed a migrated route returns
200 and does not expose `x-middleware-rewrite`
- backend build not run locally, per repository policy
2026-07-16 14:40:09 -07:00
.agents/skills feat(hexclave): PR 2 — visible rebrand (Hexclave brand goes public) (#1481) 2026-05-26 19:18:20 -07:00
.changeset Disable changesets changelogs 2026-01-12 15:21:56 -08:00
.claude refactor: migrate config parsing from Babel AST to jiti (#1661) 2026-06-29 10:25:11 -07:00
.cursor Remove afterFileLint hook from Cursor 2026-07-10 10:46:02 -07:00
.devcontainer feat(hexclave): PR 2 — visible rebrand (Hexclave brand goes public) (#1481) 2026-05-26 19:18:20 -07:00
.github Re-add Elysia backend transport 2026-07-13 12:41:55 -07:00
.vscode Make it clear there are more SDK packages 2026-06-16 10:37:58 -07:00
apps Fix Elysia production compatibility (#1757) 2026-07-16 14:40:09 -07:00
configs Silence spurious import.meta CJS warning during pnpm run dev (#1751) 2026-07-08 20:11:33 -07:00
docker Re-add Elysia backend transport 2026-07-13 12:41:55 -07:00
docs feat: add CLI Auth dashboard app (#1739) 2026-07-08 12:34:34 -07:00
docs-mintlify Add browser script/esm.sh no-bundler setup to the setup prompt (#1743) 2026-07-08 12:04:34 -07:00
examples chore: update package versions 2026-07-06 23:34:27 +00:00
packages Fix flaky payment e2e tests: await async Stripe webhook processing + deterministic fixtures (#1746) 2026-07-10 20:22:47 -07:00
patches Fix MS OAuth (#457) 2025-02-21 19:39:22 +01:00
scripts Make dev script exit when deps not running 2026-07-10 18:11:22 -07:00
sdks Hosted component hacks 2026-07-10 10:45:35 -07:00
skills/hexclave feat(hexclave): PR 5 — internal symbol/path/package renames + brand strings (#1547) 2026-06-03 18:57:09 -07:00
.dockerignore feat(hexclave): PR 5 — internal symbol/path/package renames + brand strings (#1547) 2026-06-03 18:57:09 -07:00
.gitignore [Feat] [Refactor]: Implement Bulldozer JS (#1700) 2026-07-02 10:09:46 -07:00
.gitmodules Update GitHub URL 2026-05-19 10:27:53 -07:00
AGENTS.md docs(agents): add comment-style guidance and symlink CLAUDE.md to AGENTS.md (#1725) 2026-07-10 19:17:50 -07:00
CHANGELOG.md Add 6/19/26 changelog entry (#1629) 2026-06-19 17:20:19 -07:00
CLAUDE.md docs(agents): add comment-style guidance and symlink CLAUDE.md to AGENTS.md (#1725) 2026-07-10 19:17:50 -07:00
CONTRIBUTING.md Rename port prefix envvar 2026-05-27 18:09:52 -07:00
LICENSE feat(hexclave): PR 2 — visible rebrand (Hexclave brand goes public) (#1481) 2026-05-26 19:18:20 -07:00
package.json Make dev script exit when deps not running 2026-07-10 18:11:22 -07:00
pnpm-lock.yaml Re-add Elysia backend transport 2026-07-13 12:41:55 -07:00
pnpm-workspace.yaml [Feat] [Refactor]: Implement Bulldozer JS (#1700) 2026-07-02 10:09:46 -07:00
README.md Add "For AI agents" section to README (#1563) 2026-06-05 17:01:13 -07:00
skills-lock.json Auth app redesign (#1367) 2026-05-19 23:03:46 -07:00
turbo.json dev:tui now builds packages again 2026-07-10 11:27:57 -07:00
vitest.shared.ts Migrate backend transport from Next.js to ElysiaJS (WIP) (#1630) 2026-07-09 21:39:28 -07:00
vitest.workspace.ts Hosted components (#1229) 2026-03-10 11:29:05 -07:00

Hexclave

Hexclave

The user infrastructure platform.

Hexclave handles everything around your users: authentication, teams, payments, emails, analytics, and much more. Start in minutes on the hosted cloud. Your data is always yours to export and self-host.

Website · Docs · Dashboard · Discord

License SDKs Deploy


Where Hexclave fits in the infrastructure stack

Get started

Setting up Hexclave is one prompt. Paste this into your coding agent of choice:

Read skill.hexclave.com and help me setup hexclave in this project

For AI agents

If you're an AI coding agent, use your web fetch tool or curl the skill documentation for up-to-date integration instructions:

curl -sSL "https://skill.hexclave.com?question=<your-question>&context=<your-context>"

What's included

Hexclave ships as a catalog of apps you switch on as your product needs them. Each one is built on the same user model, and new apps land regularly.

  Authentication

Authentication that just works with passkeys, OAuth, and CLI auth. Drop in one component and ship the whole flow; auth methods toggle from the dashboard with no code changes needed.

Authentication

  Teams

Build for teams, not just users, with workspaces, email invites, and roles that actually gate the work. The workspace switcher remembers selection, invites auto sign up new users, and permissions hold up under audit.

Teams

  RBAC

Permissions, sorted: roles that nest and one permission check that works the same on server or client. Define them in the dashboard, check them anywhere in your code.

RBAC

  API Keys

API keys without the footguns: leaked keys get auto-revoked, work for users and teams, and show the full secret only once. We never keep the plaintext after creation.

API Keys

  Payments

Payments without the plumbing for subscriptions, one-time charges, and usage metering with credits. Bill a person or a whole team with one model, no separate codepath.

Payments

  Emails

Email that delivers and tells you so, handling transactional and marketing sends from one API. Edit templates with an AI editor, theme once, and track every open and click.

Emails

  Analytics

Know your users with no data stack required, with live active user counts and session replays out of the box. Ask in plain English to build dashboards or write SQL to save queries, all with one flag enabled.

Analytics

  Webhooks

React to every user event in real time with signed, tamper-proof webhooks. Retries and backoff are handled for you; verify in five lines and manage endpoints from the dashboard.

Webhooks

  Data Vault

A safe for the secrets your users hand you, locked with your secret so we never see the plaintext. Store and retrieve tokens in two lines each, server-only by design.

Data Vault

  Launch Checklist

Run through the must-do checks before flipping to production: domain setup, callbacks locked, secrets rotated. The progress tracker keeps your team aligned so nothing critical slips through on launch day.

Launch Checklist

Contributing

Hexclave is open source, and contributions are welcome. Read CONTRIBUTING.md to get started, and say hello in Discord before picking up anything large. Found a security issue? Email security@hexclave.com.

❤ Contributors

Contributors