Dev log #3

Shipped new features for x this week: a Vercel adapter, a real security layer, and observability that doesn’t depend on console.log.

Vercel adapter (@thexjs/adapter-vercel)

Deploying to Vercel used to require dealing with vercel.json or using runtime hacks. The adapter now connects directly to the build pipeline and creates a proper .vercel/output/ directory. Static hydration bundles and media go to the CDN. SSR routes and server actions get packaged into a standalone Node-compatible ESM function. A config.json manifest directs static files first with SSR as the backup. No configuration is needed.

Security

@thexjs/core now checks client bundles during the build. If a server-only environment variable, such as STRIPE_SECRET_KEY, slips through without the THEXJS_PUBLIC_ prefix, the build fails immediately—preventing any leaks. Server actions reaching /__x/actions/* get automatic Origin/Referer verification with support for double-submit cookies to protect against CSRF. There’s also built-in CSP, HSTS, and X-Frame-Options headers, along with a customizable in-memory rate limiter.

Observability

Logs are now structured as JSON, including timestamp, requestId, status, and durationMs. This format works with Datadog, Loki, or Grafana without needing to parse raw text. Added /healthz and /readyz endpoints run before route matching, for those using this in Kubernetes. The createSentryReporter and createOtelReporter hooks automatically catch unhandled SSR and action errors.

Config example:

import { createApp, createSentryReporter } from "@thexjs/core";
const app = createApp({
  pagesDir: "./src/pages",
  actionsDir: "./src/actions",
  security: {
    csrf: { allowedOrigins: ["https://app.example.com"] },
    headers: { contentSecurityPolicy: "default-src 'self'" },
    rateLimit: { limit: 100, windowMs: 60_000 },
  },
  observability: {
    logging: true,
    errorReporter: createSentryReporter(Sentry),
    health: { checks: { database: () => db.ping() } },
  },
});

Still working through the rest of the PRD. Routing, i18n, and caching are next.