Hosted service

The service deploys to Vercel from apps/server. Pushing to main triggers a deploy and the E2E suite, which runs Playwright against the live site and a captcha-free preview.

Environment variables are set in the Vercel project. See Configuration for the list. Secrets such as DATABASE_URL, CAPTCHA_SECRET, and RESEND_API_KEY are injected by the platform and never committed.

The database is Neon Postgres with a dedicated auth schema.

Self-hosted

Use templates/fullstack. It is a standard Node server that serves both the API and the client pages.

npm install
npm run start

Run it behind a TLS-terminating proxy on any host that can reach Postgres. The app.fetch handler can also be adapted to a serverless function, as the hosted service does on Vercel.

CORS and origins

Set ALLOWED_ORIGIN to the exact origin that calls the API. The service responds to preflight requests and sets Access-Control-Allow-Origin to that origin only. Browser clients send tokens in the Authorization header, so cross-origin cookies are not required.

Release process

1. Update package versions and CHANGELOG.md.
2. Open a pull request; CI runs lint, tests, build, and E2E.
3. Merge, then push an annotated tag v<version>.
4. CI publishes the changed packages with npm provenance.
5. Create a GitHub Release describing what shipped.

See OPERATIONS.md for the full runbook.