Skip to main content

​
Scope and evidence

Snapshot from origin/main commit 040ebe764a (2026-10-29). The active target is per-app TanStack Start + Void + Vite+ on Cloudflare Workers, with Oxc adoption; apps/web remains last and apps/tanstack-web is paused retained source. The app/runtime distinctions below follow package manifests, deployment configs and workflow/runtime docs. Counts are reproducible rough source indicators: files under an app excluding generated/dependency directories; route-like source files and total TS/JS/RS/Dart lines. They are not URL counts or complexity scores. Current operating contracts, basePath/session behavior and release gates are in the active runtime, [native Start migration] (/build/devops/native-start-migration), [Oxc/Cloudflare adoption] (/build/development-tools/oxc-cloudflare-adoption), and [backend ownership] (/build/devops/cloudflare-backend-ownership) references. Every app must retain its exact current host until an explicit app cutover.

​
Application inventory

Authentication across Next apps primarily uses Supabase SSR and app session cookies; exact per-app variants must be preserved and inventoried in each lane. The target mounted-app contract uses the shared apex session described by the runbook. API ownership remains with the existing shared API/Web suppliers; do not move or duplicate /api ownership as an incidental frontend migration. Worker services own their explicitly configured fetch/RPC/email/scheduled contracts. Counts are intentionally conservative source indicators; Next apps use App Router and have route handlers and middleware/proxy usage to varying degrees. next/image, cacheComponents, server actions, ISR and Next cache APIs must be measured per app by the owning migration lane; a repository-wide count is not a substitute for that compatibility review. next/* access in migrated apps is through @tuturuuu/start-bridge.
  1. Shortener: two route-like modules and ~2k LOC; narrow public redirect contract. Validate redirect status, host/basePath handling, caching and abuse controls.
  2. Playground: tiny route count, but do not begin until sandbox and execution isolation contracts are mapped; small source does not mean low security risk. The current contract and its tests are in the Playground isolation contract.
  3. Tools, external, mind, chat: small surfaces; choose only after auth, API proxy, and realtime boundaries are confirmed.
  4. Parley and Lettin: already Worker-hosted, giving direct artifact/hosting continuity; do these after shared bridge and Worker acceptance patterns are proven.
  5. Small/medium Vercel satellites, grouped by domain and owner; then Apps, Drive, Rewise, AI, Forms, Nova, Track, Finance, Storefront, Calendar, Mail, Meet, Inventory, Tasks, Teach, Contacts and Infrastructure by verified compatibility score, not LOC alone.
  6. Native Workers/services (Colab, coordination, cron-control, devbox-control, Meet realtime, email routing, API and remaining services) adopt Vite+ / Oxc as separate service-scoped changes preserving their entrypoint/resource identity.
  7. Web last because it is the largest route, package and API owner and has the broadest middleware, cache, auth and integration compatibility surface.
This ordering is a proposal. Exact ownership, private acceptance evidence and cutover sequencing follow the active runtime and per-app runbooks. Mobile remains native Flutter rather than joining a web framework migration.

​
First app plan: Shortener in four PRs

  1. Inventory and contract tests: capture current deployed response/status, redirects, query preservation, custom domains, cache headers, abuse controls, session assumptions and both subdomain/basePath behavior. Add route registry and bridge compatibility findings; no hosting change.
  2. TanStack/Void adapter: add app-local Vite+ config, Start routes and Worker entry; bridge only required next/*; port redirect logic behind a framework-free function. Keep Vercel canonical.
  3. Artifact and CI acceptance: exact-head tests/type/lint/build, sealed Worker artifact inspection, binding/config parity, basePath, auth and API ownership checks; publish no production traffic.
  4. Cutover: follow the native runbook’s private production smoke, explicit reviewed routing change, immediate signed-in/public acceptance, rollback path and 30–60 minute watch. Current Vercel remains canonical until this cutover change is accepted; migration completion requires runtime evidence.
Split any phase if the route contract or bridge gaps require shared package work. No production provisioning or cutover is implied by this inventory.

​
Vector Strike reusable patterns

gh api repos/vhpx/vector-strike/contents/... was available. Its vite.config.ts uses defineConfig from vite-plus, then plugin order voidPlugin(), tanstackStart(), React; its server.ts exports Durable Object classes and dispatches /api/ to an explicit API handler before forwarding other requests to @tanstack/react-start/server-entry. Its package scripts use vp dev, vp build, vp preview, and void deploy --platform cloudflare, with typecheck and Vitest. This is a useful adapter shape, not a drop-in template: app-specific auth, bindings, resource migrations, deployment workflows, artifact acceptance and API ownership need independent proof. The accessible repo listing did not establish its complete auth/session or production workflow contract.