mirror of
https://github.com/stack-auth/stack.git
synced 2026-06-13 21:01:21 +08:00
f7e389809e
Some checks failed
all-good: Did all the other checks pass? / all-good (push) Has been cancelled
Ensure Prisma migrations are in sync with the schema / check_prisma_migrations (22.x) (push) Has been cancelled
DB migration compat / Check if migrations changed (push) Has been cancelled
Docker Server Build and Push / Docker Build and Push Server (push) Has been cancelled
Docker Server Build and Run / docker (push) Has been cancelled
Runs E2E API Tests (Local Emulator) / E2E Tests (Local Emulator, Node ${{ matrix.node-version }}) (22.x) (push) Has been cancelled
Runs E2E API Tests / E2E Tests (Node ${{ matrix.node-version }}, Freestyle ${{ matrix.freestyle-mode }}) (mock, 22.x) (push) Has been cancelled
Runs E2E API Tests / E2E Tests (Node ${{ matrix.node-version }}, Freestyle ${{ matrix.freestyle-mode }}) (prod, 22.x) (push) Has been cancelled
Runs E2E API Tests with custom port prefix / build (22.x) (push) Has been cancelled
Runs E2E Fallback Tests / E2E Fallback Tests (Node ${{ matrix.node-version }}) (22.x) (push) Has been cancelled
Lint & build / lint_and_build (24) (push) Has been cancelled
TOC Generator / TOC Generator (push) Has been cancelled
DB migration compat / Back-compat — Current branch migrations with ${{ needs.check-migrations-changed.outputs.base_branch }} branch code (push) Has been cancelled
DB migration compat / Forward-compat — Current branch code with ${{ needs.check-migrations-changed.outputs.base_branch }} branch migrations (push) Has been cancelled
DB migration compat / No migration changes (skipped) (push) Has been cancelled
## Summary
**Stacked on #1468** (`docs/hexclave-rename-plan` — the plan doc). Diff
vs that base = the actual PR 1 code.
This is **PR 1 of the Hexclave rebrand: the invisible compatibility
layer**. Everything is additive. Old SDKs, old wire identifiers, and old
env var names keep working unchanged. The backend dual-accepts and
dual-emits; new SDK code emits `x-hexclave-*` headers and the
`hexclave_` Bearer prefix; cookies dual-write; env vars dual-read across
every category. **No user-visible rebranding lands here** — that's PR 2.
See [`RENAME-TO-HEXCLAVE.md`](./RENAME-TO-HEXCLAVE.md) → *"PR 1
implementation guide"* for the full per-work-area spec, file pointers,
and chosen approach.
## What's implemented (all 14 PR-1 work-areas)
- **SDK export aliases** — `Hexclave*` aliases for the user-facing
`Stack*` exports added in `packages/template`; codegen propagates them
to `@stackframe/{js,stack,react,tanstack-start}`. React-only aliases
correctly excluded from `@stackframe/js`. (`e60550a2`)
- **JWT issuer dual-accept** — `decodeAccessToken` accepts both
`api.stack-auth.com` and `api.hexclave.com` issuers. Signing unchanged.
(`fc781def`)
- **Request-header dual-accept** — backend + dashboard proxies normalize
`x-hexclave-*` → `x-stack-*` at the existing empty proxy hook (so
`smart-request.tsx` and every route schema keep working unchanged); CORS
allowlists extended via a derive-once helper. (`2a056eac`)
- **MCP `ask_hexclave`** — registered alongside `ask_stack_auth` via a
shared helper; `ask_stack_auth` behavior byte-identical. (`30ffd604`)
- **Dev-tool** — DOM ids + header emit switched.
`window.HexclaveDevTool` exposed alongside `window.StackDevTool`.
(`32131ea7`)
- **The big consolidated commit** (`7fed864a`):
- **Env vars** — central `getEnvVariable` prefix-transform (HEXCLAVE
first, STACK fallback); dashboard + template client env files dual-read;
`turbo.json` globalEnv; `NEXT_PUBLIC_STACK_PORT_PREFIX` renamed outright
across ~82 files including docker.
- **Cookies** — dual-write/dual-read auth (`stack-access`/`-refresh-*`
and custom-domain variants), OAuth-state
(`stack-oauth-{inner,outer}-*`), and low-risk cookies (`stack-is-https`,
`stack-last-seen-changelog-version`). Bypass sites patched (backend
OAuth callback, dashboard remote-dev auth route, impersonation snippets,
snapshot serializer).
- **Bearer prefix** — SDK token parser accepts both `stackauth_` and
`hexclave_`; emits `hexclave_`. Discovery correction: this is purely
SDK-internal — the backend never parses it.
- **Response headers** — backend dual-emits
`x-hexclave-{request-id,actual-status,known-error}`; SDKs dual-read (new
first, stack fallback).
- **SDK request-header emit switch** —
`client/server/admin-interface.ts` + dashboard `api-headers.ts` +
`internal-project-headers.ts` + `feedback-form.tsx` switched to
`x-hexclave-*`. Plus `stack_response_mode` query param.
- **Storage keys** — dev-tool / cli-auth / oauth-button / docs keys
renamed (straight); `stack:session-replay:v1` dual-read so in-progress
recordings survive SDK upgrades; `stack_mfa_attempt_code` dual-read.
- **Query params** — cross-domain params dual-emit/dual-accept via
shared helpers; backend `oauth/authorize` accepts
`hexclave_response_mode` and `stack_response_mode`; `stack-init-id`
renamed.
- **`Symbol.for`** — app-internals symbol gets a parallel
`Symbol.for("Hexclave--app-internals")` getter on each attach site (no
read-site churn — old symbol still attached). 3 file-private symbols
renamed outright.
- **Config discovery** — prefer `hexclave.config.ts`, fall back to
`stack.config.ts` at every discovery site (CLI / dashboard / backend /
local-emulator); `init` writes the new filename; CLI credentials path
migrates.
- **Internal renames** — `StackAssertionError`,
`StackClient/Server/AdminInterface` renamed outright (no alias, per the
"internal-only → rename" rule). ~264 files touched.
- **Review-pass fixes** (`21217fbe`) — three real bugs found by parallel
review agents and fixed:
- `snapshot-serializer.ts` was interpolating the whole
`keyedCookieNamePrefixes` array (`${arr}`) — adding a second prefix
would have corrupted **every** OAuth-cookie snapshot, not just new ones.
- **Docker port-prefix producer/consumer mismatch** —
`entrypoint.sh`/`run-emulator.sh`/cloud-init `user-data` were still
producing `NEXT_PUBLIC_STACK_PORT_PREFIX` while the dashboard sentinel +
consumers had been renamed; silent self-host regression (custom port
prefix would be ignored).
- **Missing `hexclave-oauth-inner-*` dual-write** in the OAuth authorize
route — callback's fallback masked it but the dual-write was specified
by the plan.
- Plus: `mcp.test.ts` tool-list assertions updated to include
`ask_hexclave`; two dashboard header-emit sites switched to
`x-hexclave-*` for consistency.
- **E2E snapshot serializer follow-up** (`4b16cc5d`) —
`x-hexclave-request-id` added to the hidden-headers list (mirroring
`x-stack-request-id` treatment), and 2 sample inline snapshots
regenerated in `projects.test.ts` to include the new dual-emitted
headers.
## Verification
- **`pnpm typecheck`** — clean (the fresh-worktree `@/.source` / Prisma
codegen gap in `stack-docs` is pre-existing and unrelated).
- **`pnpm lint`** — 29/29 packages green.
- **`pnpm exec turbo run build --filter=./packages/*`** — 13/13 packages
build (including `@stackframe/stack-cli` once the dashboard standalone
is present).
- **Live E2E** against a running backend on `cl/hexclave-pr1`:
- `pnpm test run
apps/e2e/tests/backend/endpoints/api/v1/internal/mcp.test.ts` — **6/6
pass** (verifies the new `ask_hexclave` tool — the hand-written inline
snapshot matched actual MCP server output).
- `pnpm test run
apps/e2e/tests/backend/endpoints/api/v1/internal/projects.test.ts` —
**11/11 pass** (verifies wire dual-accept + dual-emit end-to-end; the
snapshot serializer fix was found and applied during this check).
A four-agent parallel **review pass** also audited the full diff for
logic/runtime bugs across the work-areas (wire headers + JWT, cookies +
bearer + symbols, env vars, query params + config + MCP + aliases). All
in-slice review verdicts were ✓ except the three bugs listed above,
which are now fixed.
## Known follow-ups (out of scope for this PR)
- **E2E snapshots across the rest of the suite** — backend now
dual-emits `x-hexclave-{known-error,actual-status}` alongside
`x-stack-*`, which legitimately appears in inline snapshots throughout
`apps/e2e`. Two were regenerated here as a sample; the rest should regen
with `vitest -u` in CI.
- **Docker shell env vars beyond `PORT_PREFIX`** — `entrypoint.sh` still
reads `STACK_*` env vars directly (the JS-side `getEnvVariable`
transform doesn't help the shell). JS consumers dual-read so it works in
practice; full shell-level dual-read is a deeper self-host follow-up.
- **`@stackframe/stack-cli` build ordering** — pre-existing; needs
`build:rde-standalone` first. Not affected by this PR.
## Test plan
- [ ] CI runs full e2e suite (with `vitest -u` to absorb dual-emit
snapshot deltas, then committed back)
- [ ] Spot-check: an old SDK build (emitting only `x-stack-*`) still
authenticates against the new backend
- [ ] Spot-check: a new SDK (emitting `x-hexclave-*` / `Bearer
hexclave_*`) still authenticates against an old backend during deploy
ordering
- [ ] Manual: `npx @stackframe/stack-cli@latest init` (new onboarding
entrypoint) generates `hexclave.config.ts`
- [ ] Manual: existing `stack.config.ts`-only project still resolves (no
migration required)
---------
Co-authored-by: bilal <bilal@stack-auth.com>
146 lines
7.9 KiB
JSON
146 lines
7.9 KiB
JSON
{
|
|
"name": "@stackframe/backend",
|
|
"version": "2.8.103",
|
|
"repository": "https://github.com/hexclave/stack-auth",
|
|
"private": true,
|
|
"type": "module",
|
|
"scripts": {
|
|
"clean": "rimraf src/generated && rimraf .next && rimraf node_modules",
|
|
"typecheck": "tsc --noEmit",
|
|
"with-env": "dotenv -c --",
|
|
"with-env:dev": "dotenv -c development --",
|
|
"with-env:prod": "dotenv -c production --",
|
|
"with-env:test": "dotenv -c test --",
|
|
"dev": "BACKEND_PORT=${STACK_DEV_FALLBACK_BACKEND:+${NEXT_PUBLIC_HEXCLAVE_PORT_PREFIX:-81}10} && BACKEND_PORT=${BACKEND_PORT:-${NEXT_PUBLIC_HEXCLAVE_PORT_PREFIX:-81}02} && concurrently -n \"dev,codegen,prisma-studio,email-queue,cron-jobs,bulldozer-studio\" -k \"STACK_DISABLE_REACT_ASYNC_DEBUG_INFO=${STACK_DISABLE_REACT_ASYNC_DEBUG_INFO:-true} next dev --port $BACKEND_PORT ${STACK_BACKEND_DEV_EXTRA_ARGS:-}\" \"pnpm run codegen:watch\" \"pnpm run prisma-studio\" \"pnpm run run-email-queue\" \"pnpm run run-cron-jobs\" \"pnpm run run-bulldozer-studio\"",
|
|
"dev:inspect": "STACK_BACKEND_DEV_EXTRA_ARGS=\"--inspect\" pnpm run dev",
|
|
"dev:profile": "STACK_BACKEND_DEV_EXTRA_ARGS=\"--experimental-cpu-prof\" pnpm run dev",
|
|
"build": "pnpm run codegen && next build",
|
|
"docker-build": "pnpm run codegen && next build --experimental-build-mode compile",
|
|
"build-self-host-migration-script": "tsdown --config scripts/db-migrations.tsdown.config.ts",
|
|
"analyze-bundle": "next experimental-analyze",
|
|
"start": "next start --port ${NEXT_PUBLIC_HEXCLAVE_PORT_PREFIX:-81}02",
|
|
"codegen-prisma": "STACK_DATABASE_CONNECTION_STRING=\"${STACK_DATABASE_CONNECTION_STRING:-placeholder-database-connection-string}\" pnpm run prisma generate",
|
|
"codegen-prisma:watch": "STACK_DATABASE_CONNECTION_STRING=\"${STACK_DATABASE_CONNECTION_STRING:-placeholder-database-connection-string}\" pnpm run prisma generate --watch",
|
|
"generate-private-sign-up-risk-engine": "pnpm run with-env tsx scripts/generate-private-sign-up-risk-engine.ts",
|
|
"generate-private-sign-up-risk-engine:watch": "chokidar 'src/private/src/sign-up-risk-engine.ts' -c 'pnpm run generate-private-sign-up-risk-engine'",
|
|
"codegen-route-info": "pnpm run with-env tsx scripts/generate-route-info.ts",
|
|
"codegen-route-info:watch": "pnpm run with-env tsx watch --clear-screen=false scripts/generate-route-info.ts",
|
|
"codegen": "pnpm run with-env pnpm run generate-migration-imports && pnpm run with-env bash -c 'if [ \"$STACK_ACCELERATE_ENABLED\" = \"true\" ]; then pnpm run prisma generate --no-engine; else pnpm run codegen-prisma; fi' && pnpm run generate-private-sign-up-risk-engine && pnpm run codegen-docs && pnpm run codegen-route-info",
|
|
"codegen:watch": "pnpm run generate-private-sign-up-risk-engine && concurrently -n \"prisma,private-risk-engine,docs,route-info,migration-imports\" -k \"pnpm run codegen-prisma:watch\" \"pnpm run generate-private-sign-up-risk-engine:watch\" \"pnpm run codegen-docs:watch\" \"pnpm run codegen-route-info:watch\" \"pnpm run generate-migration-imports:watch\"",
|
|
"psql-inner": "psql $(echo $STACK_DATABASE_CONNECTION_STRING | sed 's/\\?.*$//')",
|
|
"clickhouse": "pnpm run with-env clickhouse-client --host localhost --port ${NEXT_PUBLIC_HEXCLAVE_PORT_PREFIX:-81}37 --user stackframe --password PASSWORD-PLACEHOLDER--9gKyMxJeMx",
|
|
"psql": "pnpm run with-env:dev pnpm run psql-inner",
|
|
"prisma-studio": "pnpm run with-env:dev prisma studio --port ${NEXT_PUBLIC_HEXCLAVE_PORT_PREFIX:-81}06 --browser none",
|
|
"prisma:dev": "pnpm run with-env:dev prisma",
|
|
"prisma": "pnpm run with-env prisma",
|
|
"db:migration-gen": "pnpm run with-env:dev tsx scripts/db-migrations.ts generate-migration-file",
|
|
"db:reset": "pnpm run with-env:dev tsx scripts/db-migrations.ts reset",
|
|
"db:seed": "pnpm run with-env:dev tsx scripts/db-migrations.ts seed",
|
|
"db:init": "pnpm run with-env:dev tsx scripts/db-migrations.ts init",
|
|
"db:migrate": "pnpm run with-env:dev tsx scripts/db-migrations.ts migrate",
|
|
"db:backfill-internal-free-plans": "pnpm run with-env:dev tsx scripts/db-migrations.ts backfill-internal-free-plans",
|
|
"db:regen-internal-subscriptions-to-latest": "pnpm run with-env:dev tsx scripts/db-migrations.ts regen-internal-subscriptions-to-latest",
|
|
"generate-migration-imports": "pnpm run with-env tsx scripts/generate-migration-imports.ts",
|
|
"generate-migration-imports:watch": "chokidar 'prisma/migrations/**/*.sql' -c 'pnpm run generate-migration-imports'",
|
|
"lint": "eslint .",
|
|
"codegen-docs": "pnpm run with-env tsx scripts/generate-openapi-fumadocs.ts",
|
|
"codegen-docs:watch": "pnpm run with-env tsx watch --exclude '**/node_modules/**' --clear-screen=false scripts/generate-openapi-fumadocs.ts",
|
|
"generate-keys": "pnpm run with-env tsx scripts/generate-keys.ts",
|
|
"db-seed-script": "pnpm run db:seed",
|
|
"run-cron-jobs": "pnpm run with-env:dev tsx scripts/run-cron-jobs.ts",
|
|
"run-cron-jobs:test": "pnpm run with-env:test tsx scripts/run-cron-jobs.ts",
|
|
"verify-data-integrity": "pnpm run with-env:dev tsx scripts/verify-data-integrity/index.ts",
|
|
"run-email-queue": "pnpm run with-env:dev tsx scripts/run-email-queue.ts",
|
|
"run-bulldozer-studio": "pnpm run with-env:dev tsx watch --clear-screen=false scripts/run-bulldozer-studio.ts"
|
|
},
|
|
"prisma": {
|
|
"seed": "pnpm run db-seed-script"
|
|
},
|
|
"dependencies": {
|
|
"@ai-sdk/mcp": "^1.0.21",
|
|
"spacetimedb": "^2.1.0",
|
|
"@ai-sdk/openai": "^3.0.29",
|
|
"@aws-sdk/client-s3": "^3.855.0",
|
|
"@clickhouse/client": "^1.14.0",
|
|
"@node-oauth/oauth2-server": "^5.1.0",
|
|
"@openrouter/ai-sdk-provider": "2.2.3",
|
|
"@opentelemetry/api": "^1.9.0",
|
|
"@opentelemetry/api-logs": "^0.53.0",
|
|
"@opentelemetry/auto-instrumentations-node": "^0.71.0",
|
|
"@opentelemetry/context-async-hooks": "^1.26.0",
|
|
"@opentelemetry/core": "^1.26.0",
|
|
"@opentelemetry/exporter-trace-otlp-http": "^0.53.0",
|
|
"@opentelemetry/instrumentation": "^0.53.0",
|
|
"@opentelemetry/resources": "^1.26.0",
|
|
"@opentelemetry/sdk-logs": "^0.53.0",
|
|
"@opentelemetry/sdk-trace-base": "^1.26.0",
|
|
"@opentelemetry/sdk-trace-node": "^1.26.0",
|
|
"@opentelemetry/semantic-conventions": "^1.27.0",
|
|
"@oslojs/otp": "^1.1.0",
|
|
"@prisma/adapter-neon": "^7.0.0",
|
|
"@prisma/adapter-pg": "^7.0.0",
|
|
"@prisma/client": "^7.0.0",
|
|
"@prisma/extension-read-replicas": "^0.5.0",
|
|
"@prisma/instrumentation": "^7.0.0",
|
|
"@react-email/render": "^1.2.1",
|
|
"@sentry/nextjs": "^10.45.0",
|
|
"@simplewebauthn/server": "^13.3.0",
|
|
"@stackframe/stack": "workspace:*",
|
|
"@stackframe/stack-shared": "workspace:*",
|
|
"@upstash/qstash": "^2.8.2",
|
|
"@vercel/functions": "^2.0.0",
|
|
"@vercel/otel": "^1.10.4",
|
|
"@vercel/sandbox": "^1.2.0",
|
|
"ai": "^6.0.0",
|
|
"bcrypt": "^6.0.0",
|
|
"cel-js": "^0.8.2",
|
|
"chokidar-cli": "^3.0.0",
|
|
"dotenv": "^16.4.5",
|
|
"dotenv-cli": "^7.3.0",
|
|
"elkjs": "^0.11.1",
|
|
"emailable": "^3.1.1",
|
|
"freestyle-sandboxes": "^0.1.6",
|
|
"jiti": "^2.6.1",
|
|
"jose": "^6.1.3",
|
|
"json-diff": "^1.0.6",
|
|
"next": "16.1.7",
|
|
"nodemailer": "^6.9.10",
|
|
"oidc-provider": "^8.5.1",
|
|
"openid-client": "5.6.4",
|
|
"pg": "^8.16.3",
|
|
"postgres": "^3.4.5",
|
|
"posthog-node": "^4.1.0",
|
|
"react": "19.2.3",
|
|
"react-dom": "19.2.3",
|
|
"resend": "^6.0.1",
|
|
"semver": "^7.6.3",
|
|
"sharp": "^0.34.4",
|
|
"stripe": "^18.3.0",
|
|
"svix": "^1.89.0",
|
|
"vite": "^6.1.0",
|
|
"yaml": "^2.4.5",
|
|
"yup": "^1.7.1",
|
|
"zod": "^3.23.8"
|
|
},
|
|
"devDependencies": {
|
|
"@simplewebauthn/types": "^11.0.0",
|
|
"@types/json-diff": "^1.0.3",
|
|
"@types/node": "20.17.6",
|
|
"@types/nodemailer": "^6.4.14",
|
|
"@types/oidc-provider": "^8.5.1",
|
|
"@types/pg": "^8.16.0",
|
|
"@types/react": "19.2.7",
|
|
"@types/react-dom": "19.2.3",
|
|
"@types/semver": "^7.5.8",
|
|
"concurrently": "^8.2.2",
|
|
"glob": "^10.4.1",
|
|
"import-in-the-middle": "1.14.2",
|
|
"prisma": "^7.0.0",
|
|
"require-in-the-middle": "^7.4.0",
|
|
"rimraf": "^5.0.5",
|
|
"tsdown": "^0.20.3",
|
|
"tsx": "^4.7.2"
|
|
},
|
|
"packageManager": "pnpm@10.23.0"
|
|
}
|