mirror of https://github.com/stack-auth/stack.git synced 2026-07-20 21:29:36 +08:00

History

BilalG1 81433e5181 feat(emails): arbitrary-recipient send + Emailable on managed domains (#1681 ) ## Summary Two related email changes: ### 1. Send to arbitrary email addresses The `sendEmail` SDK function and `POST /api/v1/emails/send-email` now accept a third recipient selector, `emails: string[]`, mutually exclusive (XOR) with `user_ids` and `all_users`. These recipients don't have to belong to a user — they're mapped to the existing internal `custom-emails` recipient type (no associated user object, can't unsubscribe, so intended for transactional mail). - Response `results` items are now `{ user_id?, email? }`; the `emails` path returns `{ email }`. - Validation message updated to `Exactly one of user_ids, all_users, or emails must be provided`. - Recipient addresses are validated with the shared `emailSchema`. ### 2. Run Emailable on managed custom domains `LowLevelEmailConfig.type` is widened `'shared' \| 'standard'` → `'shared' \| 'managed' \| 'standard'`, and `getEmailConfig` returns `'managed'` for the managed-Resend branch. The Emailable deliverability check now runs for shared and managed, and is skipped for `standard` (a customer's own SMTP server or Resend API key). Why: managed domains send through our single Resend account (per-domain scoped keys, but shared account → account-level bounce penalties are collateral across managed customers), so we own that reputation. With a custom SMTP server or the customer's own Resend key, the customer owns their deliverability, so we don't second-guess their recipients or spend Emailable checks on their volume. The shared dev-email wrapper remains `shared`-only. ## Tests - `send-email.test.ts`: added arbitrary-recipient send (single/multiple), empty-array, and validation cases (both-selectors, no-selector, invalid email); updated the exactly-one-of snapshot. 24/24 pass. - New `emails/deliverability-gating.test.ts`: shared & managed skip an undeliverable address (`LIKELY_NOT_DELIVERABLE`), custom SMTP still sends. 3/3 pass. > Note: `email-queue.test.ts` has 2 pre-existing snapshot failures (a `margin:0rem`→`margin:0` CSS normalization in rendered email HTML) that are unrelated to this change — confirmed by reproducing them on `dev` with these changes stashed. <!-- This is an auto-generated description by cubic. --> --- ## Summary by cubic Adds support for sending emails to arbitrary addresses and enables Emailable checks for managed domains to protect shared sending reputation. The API/SDK now accept `emails: string[]` as a recipient selector, and deliverability checks run on shared and managed sending. - New Features - API/SDK: `emails: string[]` recipient selector (XOR with `user_ids`/`all_users`) in `sendEmail` and POST /api/v1/emails/send-email. Results return `{ email }` for this path; addresses validated via `emailSchema`. Recipients map to transactional-only “custom-emails” (no user, no unsubscribe). - Deliverability: email config adds `'managed'`; `getEmailConfig` returns it for managed Resend domains. Emailable check runs for `shared` and `managed`; skipped for `standard` (custom SMTP or customer Resend key). <sup>Written for commit `e48cf2ddda`. Summary will update on new commits.</sup> <a href="https://cubic.dev/pr/hexclave/hexclave/pull/1681?utm_source=github" target="_blank" rel="noopener noreferrer" data-no-image-dialog="true"><picture><source media="(prefers-color-scheme: dark)" srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img alt="Review in cubic" src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a> <!-- End of auto-generated description by cubic. --> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * New Features * Emails can now be sent to arbitrary email addresses, not just existing users. * Email sending APIs and client options now accept an email list as a recipient choice. * Bug Fixes * Improved recipient validation so exactly one target type must be chosen. * Fixed response results to consistently show either a user ID or an email address. * Corrected deliverability checks for managed email setups and updated skip behavior for undeliverable addresses. <!-- end of auto-generated comment: release notes by coderabbit.ai -->		2026-06-30 11:16:25 -07:00
..
scripts	Rename STACK_* env vars to HEXCLAVE_* in env templates, with legacy dual-read (#1588 )	2026-06-19 18:58:53 -07:00
src	feat(emails): arbitrary-recipient send + Emailable on managed domains (#1681 )	2026-06-30 11:16:25 -07:00
.env	Vanilla JS client library (#408 )	2025-02-08 02:31:03 +01:00
.eslintrc.cjs	Fix Vite environment variables	2026-06-05 16:42:11 -07:00
.gitignore	Vanilla JS client library (#408 )	2025-02-08 02:31:03 +01:00
components.json	Vanilla JS client library (#408 )	2025-02-08 02:31:03 +01:00
LICENSE	Vanilla JS client library (#408 )	2025-02-08 02:31:03 +01:00
next-env.d.ts	Vanilla JS client library (#408 )	2025-02-08 02:31:03 +01:00
package-template.json	chore: update package versions	2026-06-30 18:04:45 +00:00
package.json	chore: update package versions	2026-06-30 18:04:45 +00:00
postcss.config.js	Vanilla JS client library (#408 )	2025-02-08 02:31:03 +01:00
quetzal.config.json	Vanilla JS client library (#408 )	2025-02-08 02:31:03 +01:00
README.md	Add README files to all published @hexclave npm packages (#1608 )	2026-06-18 10:17:10 -07:00
tailwind.config.js	feat(hexclave): PR 3 — native @hexclave/* source rename + delete dual-publish wiring (#1482 )	2026-05-29 15:21:59 -07:00
tsconfig.json	In-source unit tests (#429 )	2025-02-14 11:47:52 -08:00
tsdown.config.ts	Fix build	2026-02-27 00:48:07 -08:00
vitest.config.ts	feat(hexclave): PR 3 — native @hexclave/* source rename + delete dual-publish wiring (#1482 )	2026-05-29 15:21:59 -07:00

README.md

Hexclave

The user infrastructure platform.

Hexclave handles everything around your users: authentication, teams, payments, emails, analytics, and much more. Start in minutes on the hosted cloud. Your data is always yours to export and self-host.

Website · Docs · Dashboard · Discord

Where Hexclave fits in the infrastructure stack

Get started

Setting up Hexclave is one prompt. Paste this into your coding agent of choice:

Read skill.hexclave.com and help me setup hexclave in this project

For AI agents

If you're an AI coding agent, use your web fetch tool or curl the skill documentation for up-to-date integration instructions:

curl -sSL "https://skill.hexclave.com?question=<your-question>&context=<your-context>"

What's included

Hexclave ships as a catalog of apps you switch on as your product needs them. Each one is built on the same user model, and new apps land regularly.

Authentication

Authentication that just works with passkeys, OAuth, and CLI auth. Drop in one component and ship the whole flow; auth methods toggle from the dashboard with no code changes needed.

Teams

Build for teams, not just users, with workspaces, email invites, and roles that actually gate the work. The workspace switcher remembers selection, invites auto sign up new users, and permissions hold up under audit.

RBAC

Permissions, sorted: roles that nest and one permission check that works the same on server or client. Define them in the dashboard, check them anywhere in your code.

API Keys

API keys without the footguns: leaked keys get auto-revoked, work for users and teams, and show the full secret only once. We never keep the plaintext after creation.

Payments

Payments without the plumbing for subscriptions, one-time charges, and usage metering with credits. Bill a person or a whole team with one model, no separate codepath.

Emails

Email that delivers and tells you so, handling transactional and marketing sends from one API. Edit templates with an AI editor, theme once, and track every open and click.

Analytics

Know your users with no data stack required, with live active user counts and session replays out of the box. Ask in plain English to build dashboards or write SQL to save queries, all with one flag enabled.

Webhooks

React to every user event in real time with signed, tamper-proof webhooks. Retries and backoff are handled for you; verify in five lines and manage endpoints from the dashboard.

Data Vault

A safe for the secrets your users hand you, locked with your secret so we never see the plaintext. Store and retrieve tokens in two lines each, server-only by design.

Launch Checklist

Run through the must-do checks before flipping to production: domain setup, callbacks locked, secrets rotated. The progress tracker keeps your team aligned so nothing critical slips through on launch day.

Contributing

Hexclave is open source, and contributions are welcome. Read CONTRIBUTING.md to get started, and say hello in Discord before picking up anything large. Found a security issue? Email security@hexclave.com.