The work is complete — I did not lose it. Pasting the final deliverable below verbatim.
Every repo row was verified via gh api repos/OWNER/NAME on 2026-08-29. Stars, licence, and last-push are as of that date. Where the API returned NOASSERTION, I read the actual LICENSE file text via gh api repos/OWNER/NAME/license.
OSS Prior-Art Hunt — HALO Angels CRM
TOP 8 OVERALL PICKS
| # | Repo | Why |
|---|---|---|
| 1 | get-convex/better-auth (765★, Apache-2.0) | The single highest-fit find: Convex's own Better Auth component. Kills bespoke SHA-256/localStorage auth with a first-party adapter, not a bolt-on. |
| 2 | better-auth/better-auth (29,744★, MIT) | The engine behind #1. MIT, TS-native, sessions/OAuth/2FA/orgs. Auth solved without a separate service. |
| 3 | get-convex/convex-test (22★, Apache-2.0) | In-memory Convex backend mock. The only way to unit-test 57 tables of Convex functions. Zero-tests problem starts here. |
| 4 | get-convex/convex-helpers (489★, Apache-2.0) | Custom functions/ctx wrappers, relationship helpers, validators, session storage. Directly deletes hand-rolled Convex boilerplate. |
| 5 | stalniy/casl (7,063★, MIT) | Isomorphic TS authz. Role ladder + per-resource flags is exactly its shape. Same rules run in Convex functions and React. |
| 6 | get-convex/workflow + workpool + action-retrier | Durable execution for the Drive scan/index/thumbnail pipeline. Replaces ad-hoc scheduler chains that silently die. |
| 7 | docusealco/docuseal (18,398★, AGPL-3.0) | Best-engineered e-sign of the three; embeddable form builder. AGPL flagged. |
| 8 | lovell/sharp (32,613★, Apache-2.0) | Thumbnail generation, in-process. No thumbor/imgproxy service to run. |
Lane 1 — Auth
| Repo | ★ | Licence | Pushed | Replaces | Difficulty | Verdict |
|---|---|---|---|---|---|---|
| get-convex/better-auth | 765 | Apache-2.0 | 2026-08-28 | Bespoke auth table + localStorage | Drop-in component | The answer. First-party Convex↔Better Auth component, actively developed. |
| better-auth/better-auth | 29,744 | MIT | 2026-08-28 | Same | Library | Cleanest licence in the lane; the framework #1 wraps. |
| get-convex/convex-auth | 179 | NO LICENCE FILE | 2026-08-29 | Same | Drop-in | Convex's older built-in auth. 154 open issues; Convex has visibly shifted energy to the Better Auth component. Legal risk: no LICENSE at all. |
| get-convex/workos-authkit | 22 | Apache-2.0 | 2026-08-27 | Same | Component | Real, but ties you to WorkOS's hosted service. |
| lucia-auth/lucia | 10,450 | MIT | 2026-08-08 | — | — | Confirmed: your recollection is right. Repo is alive but repositioned as a learning resource, not a library. Do not adopt as a dependency. |
| zitadel/zitadel | 14,890 | AGPL-3.0 | 2026-08-29 | Same | Separate service | Excellent IdP, wrong weight class for one CRM. |
| keycloak/keycloak | 36,475 | Apache-2.0 | 2026-08-29 | Same | Separate JVM service | Enterprise-grade, enormous operational tax. |
| ory/kratos | 13,855 | Apache-2.0 | 2026-07-29 | Same | Separate service | Headless and clean, but no Convex story. |
| hexclave/hexclave (was stack-auth) | 6,843 | MIT client / AGPL server | 2026-08-28 | Same | Service + SDK | Renamed since you listed it. Rebrand churn = adoption risk. |
| supertokens/supertokens-core | 15,288 | Apache-2.0 (+ ee/ proprietary) | 2026-08-28 | Same | Separate service | Solid, but a Java service beside Convex. |
| nextauthjs/next-auth | 28,350 | ISC | 2026-07-22 | Same | Adapter needed | Next.js-shaped; you're on Vite + react-router. Poor fit. |
Convex-specific answer: only get-convex/better-auth, get-convex/convex-auth, and get-convex/workos-authkit integrate with Convex natively. Everything else needs a custom bridge.
Lane 2 — RBAC / Permissions
| Repo | ★ | Licence | Pushed | Difficulty | Verdict |
|---|---|---|---|---|---|
| stalniy/casl | 7,063 | MIT | 2026-08-26 | Drop-in library | Best fit. Pure TS, no service, subject/field-level rules — matches a role ladder + per-resource flags precisely. |
| apache/casbin-node-casbin | 2,917 | Apache-2.0 | 2026-08-13 | Library | Note: moved to the apache/ org. Policy-file model is heavier than CASL for this shape. |
| openfga/openfga | 5,673 | Apache-2.0 | 2026-08-28 | Separate service | Zanzibar done well; overkill unless you need relationship-based sharing on the content drive. |
| authzed/spicedb | 6,999 | Apache-2.0 | 2026-08-28 | Separate service | Strongest Zanzibar engine. Same overkill verdict. |
| Permify/permify | 5,942 | AGPL-3.0 | 2026-08-28 | Separate service | Now part of FusionAuth — acquisition = roadmap risk. |
| osohq/oso | 3,491 | Apache-2.0 | 2025-02-26 | — | Deprecated — README says so. Do not adopt. |
Lane 3 — E-signature / Contracts
| Repo | ★ | Licence (LICENSE read) | Pushed | Difficulty | Verdict |
|---|---|---|---|---|---|
| docusealco/docuseal | 18,398 | AGPL-3.0 | 2026-08-25 | Separate service + embed | Best DX; embeddable signing form. Ruby service alongside Convex. |
| documenso/documenso | 14,796 | AGPL-3.0 | 2026-08-29 | Separate service | TypeScript — closest to your stack for code-lifting. Most active of the three. |
| OpenSignLabs/OpenSign | 6,931 | AGPL-3.0 + proprietary customRoute/ dir | 2026-08-21 | Separate service | Mixed licence with a carved-out proprietary directory. Messiest of the three. |
All three are AGPL. Flagged as metadata per your rule, not eliminated. Documenso is the one whose code you could actually study/lift given it's TS.
Lane 4 — Invoicing / Billing / Multi-currency
| Repo | ★ | Licence (verified) | Pushed | Difficulty | Verdict |
|---|---|---|---|---|---|
| getlago/lago | 10,438 | AGPL-3.0 | 2026-08-28 | Separate service + API | Best-engineered billing engine here; API-first so it composes rather than replaces. |
| killbill/killbill | 5,706 | Apache-2.0 | 2026-08-22 | Separate JVM service | Cleanest licence in the lane. Battle-tested, heavy Java deployment. |
| midday-ai/midday | 14,935 | AGPL-3.0 | 2026-06-13 | Study / lift patterns | TypeScript, gorgeous invoicing UX — steal the patterns. Slowing (2.5mo since push). |
| solidtime-io/solidtime | 8,886 | AGPL-3.0 | 2026-08-28 | Separate app | Time-tracking, adjacent to payroll/attendance. Laravel. |
| invoiceninja/invoiceninja | 10,034 | ELv2 — hosting clause | 2026-08-27 | Separate PHP app | ELv2 explicitly forbids offering it as a hosted service. Highest commercial risk in this doc. |
| InvoicePlane/InvoicePlane | 3,126 | Trademark-restricted + open code | 2026-08-28 | Separate PHP app | Dated CodeIgniter stack. |
| crater-invoice-inc/crater | 8,341 | AGPL-3.0 | 2024-08-10 | — | Stale ~2 years. Do not adopt. (Also renamed from crater-invoice/crater.) |
Honest read: none of these lift as a library into Convex. Multi-currency creator + referral invoicing stays yours; Lago or Kill Bill are the only credible "run it beside us" options.
Lane 5 — Credential Vault / Secrets
| Repo | ★ | Licence (verified) | Pushed | Difficulty | Verdict |
|---|---|---|---|---|---|
| FiloSottile/age | 23,350 | BSD-3-Clause | 2026-08-28 | Library/CLI | Recommended pattern. Envelope-encrypt each credential to a KMS-held key; store ciphertext in Convex. Smallest correct change. |
| jedisct1/libsodium.js | 1,152 | ISC | 2026-07-14 | Drop-in library | WASM libsodium — crypto_secretbox + per-record nonce, runnable in Convex actions. The "do it properly" option. |
| Infisical/infisical | 29,010 | MIT core + proprietary ee/ | 2026-08-29 | Separate service | Best-licensed full platform. Real infra to run. |
| openbao/openbao | 7,194 | MPL-2.0 | 2026-08-28 | Separate service | Vault fork under a genuinely open licence. |
| dani-garcia/vaultwarden | 66,439 | AGPL-3.0 | 2026-08-24 | Separate service | Human password manager, not app-level secrets. Wrong tool for secureAreaPasswords. |
| passbolt/passbolt_api | 6,095 | AGPL-3.0 | 2026-08-21 | Separate service | Same wrong-shape verdict. |
| hashicorp/vault | 36,185 | BSL 1.1 (now IBM) | 2026-08-28 | Separate service | Licence changed to BSL; use OpenBao instead. |
Verdict for this lane: don't adopt a vault product. Do envelope encryption with libsodium/age and a real KMS key. That's a ~200-line fix, not a service.
Lane 6 — File / DAM Pipeline
| Repo | ★ | Licence (verified) | Pushed | Difficulty | Verdict |
|---|---|---|---|---|---|
| lovell/sharp | 32,613 | Apache-2.0 | 2026-08-28 | Drop-in library | Thumbnails in-process. No extra service. Take this. |
| googleapis/google-api-nodejs-client | 12,236 | Apache-2.0 | 2026-08-28 | Library | Official Drive client — incremental changes.list + pageToken beats full rescans. |
| get-convex/r2 | 49 | Apache-2.0 | 2026-08-28 | Convex component | Move derived thumbnails to R2; kill egress cost. |
| immich-app/immich | 112,891 | AGPL-3.0 | 2026-08-28 | Study | Best prior art anywhere for scan→hash→thumbnail→index job queues. Read it, don't run it. |
| imgproxy/imgproxy | 11,034 | Apache-2.0 | 2026-08-27 | Separate service | On-the-fly resizing with signed URLs. Adopt only if sharp proves too slow. |
| thumbor/thumbor | 10,514 | MIT | 2026-08-27 | Separate service | Mature but Python; cleanest licence of the two proxies. |
| rclone/rclone | 59,438 | MIT | 2026-08-28 | CLI/binary | Bulletproof Drive sync if you ever need bulk mirroring. |
| photoprism/photoprism | 40,117 | AGPL-3.0 | 2026-08-28 | Study | Taxonomy/auto-labelling prior art. |
| CaramelFur/Picsur | 1,246 | AGPL-3.0 | — | Separate service | Note: the owner is CaramelFur, not CaiJimmy — CaiJimmy/picsur returns 404. Small; skip. Stars/licence verified via gh search repos; last-push unverified. |
Lane 7 — Gamification / Quests / XP
This lane is empty. Reporting it honestly.
| Repo | ★ | Licence | Pushed | Verdict |
|---|---|---|---|---|
| ActiDoo/gamification-engine | 474 | MIT | 2023-02-15 | Best OSS gamification engine that exists — and it's Python, 3.5 years stale. |
| agoragames/leaderboard | 481 | MIT | 2021-03-11 | Ruby, 5 years stale. |
Everything else returned by search is sub-100★ or abandoned pre-2015. There is no maintained TypeScript gamification engine. Quests/XP/shop/ranks is a domain-specific state machine — keep it bespoke. The only sensible OSS help is get-convex/aggregate (31★, Apache-2.0, pushed 2026-08-28) for leaderboard sums/counts without O(n) scans, and get-convex/workflow for multi-step quest chains.
Lane 8 — Admin Panel / CRUD Scaffolding
| Repo | ★ | Licence (verified) | Pushed | Difficulty | Verdict |
|---|---|---|---|---|---|
| refinedev/refine | 35,593 | MIT | 2026-06-05 | Framework, headless | Best fit for the 39-pages problem. Headless + shadcn-compatible, so you keep your UI. Needs a Convex data provider (~1 file). Note the 2.5-month push gap. |
| marmelab/react-admin | 26,914 | MIT | 2026-08-27 | Framework | Very actively maintained, but Material-UI opinionated — fights your shadcn/Tailwind design. |
| appsmithorg/appsmith | 40,779 | Apache-2.0 | 2026-08-29 | Separate service | Best-licensed platform, but a parallel app; you'd have two UIs. |
| ToolJet/ToolJet | 40,787 | AGPL-3.0 | 2026-08-28 | Separate service | Same shape as Appsmith. |
| Budibase/budibase | 28,246 | GPLv3 overall + BSL on /packages/pro | 2026-08-28 | Separate service | Paid features are BSL-fenced. |
| directus/directus | 37,677 | MSCL-1.0-GPL (source-available, new) | 2026-08-28 | Separate service | Licence changed to Monospace Sustainable Core License. No longer plain GPL. |
| tremorlabs/tremor | 3,586 | Apache-2.0 | 2025-10-10 | Copy-paste | Dashboard charts. ~10 months stale — check before depending. |
| twentyhq/twenty | 55,812 | AGPL-3.0 (+ @license Enterprise files) | 2026-08-29 | Study | A real CRM's data model, worth reading for the creator/contact domain. |
Refine realistically compresses list/create/edit/show pages — maybe 30-40% of the 80k LOC, not 80%. The domain screens (Drive taxonomy, voice cloning, quests) won't scaffold.
Lane 9 — Testing
Minimum credible harness, all MIT/Apache, all actively pushed:
| Repo | ★ | Licence | Pushed | Role |
|---|---|---|---|---|
| vitest-dev/vitest | 17,022 | MIT | 2026-08-28 | Runner. Zero-config with your existing Vite setup. |
| get-convex/convex-test | 22 | Apache-2.0 | 2026-08-27 | Load-bearing. In-memory Convex backend; test queries/mutations/actions without a deployment. |
| testing-library/react-testing-library | 19,646 | MIT | 2026-08-27 | Component tests. |
| microsoft/playwright | 95,316 | Apache-2.0 | 2026-08-29 | E2E: login → invoice → payment log. |
| mswjs/msw | 18,174 | MIT | 2026-07-24 | Mock ElevenLabs/Drive/Stripe at the network layer. |
Order of adoption: Vitest + convex-test first (highest value per hour — 57 tables of untested mutations), then Playwright on 3-5 money paths, then RTL, then MSW.
Lane 10 — Convex Ecosystem (highest-fit lane)
Every component below is Apache-2.0, first-party (get-convex), and pushed within the last week.
| Component | ★ | Pushed | What it replaces here |
|---|---|---|---|
| convex-helpers | 489 | 2026-08-27 | Hand-rolled auth wrappers, relationship joins, validators, session storage. Highest LOC-deleted-per-hour. |
| better-auth | 765 | 2026-08-28 | The bespoke auth table. |
| convex-test | 22 | 2026-08-27 | Nothing — it fills the zero-test hole. |
| workflow | 80 | 2026-08-27 | Multi-step Drive scan/index/thumbnail chains; durable, survives failures. |
| workpool | 31 | 2026-08-28 | Bounded parallelism so a Drive scan can't exhaust the action budget. |
| action-retrier | 12 | 2026-08-28 | Retry logic around ElevenLabs / Drive / payment calls. |
| migrations | 20 | 2026-08-27 | The Supabase→Convex migration itself — tracked, resumable stateful migrations. |
| table-history | 22 | 2026-08-27 | Audit log for contracts, payments, payroll. Compliance-relevant. |
| aggregate | 31 | 2026-08-28 | Dashboard analytics + gamification leaderboards without O(n) scans. |
| rate-limiter | 27 | 2026-08-29 | Login throttling — your bespoke auth almost certainly has none. |
| crons | 6 | 2026-08-27 | Runtime-configurable crons vs. hardcoded crons.ts. |
| r2 | 49 | 2026-08-28 | Cloudflare R2 file storage for thumbnails. |
| presence | 19 | 2026-08-26 | Messaging online-indicators. |
| stripe | 78 | 2026-08-27 | Payment log ingestion. |
| resend | 39 | 2026-08-28 | Transactional email with delivery tracking. |
| agent | 346 | 2026-08-28 | Persistent AI chat history if the voice/AI features grow. |
| rag | 36 | 2026-08-28 | Semantic search over the content drive. |
| templates | 135 | 2026-08-28 | Official Convex starters. |
| convex-ents | 58 | 2026-08-22 | Schema/relations ergonomics — but no LICENSE file, and slower cadence. |
DO NOT ADOPT
- osohq/oso (3,491★) — README declares it deprecated; last push 2025-02-26.
- lucia-auth/lucia (10,450★) — your recollection is correct; repositioned as a learning resource, not a maintained library.
- crater-invoice-inc/crater (8,341★) — last push 2024-08-10. Stale ~2 years and the owner org renamed.
- hashicorp/vault (36,185★) — LICENSE is now BSL 1.1 under IBM, not MPL. Use OpenBao.
- invoiceninja/invoiceninja (10,034★) — ELv2 with an explicit no-hosted-service clause. Highest commercial risk in this document for a client-adjacent product.
- directus/directus (37,677★) — silently moved to the Monospace Sustainable Core License. Anyone citing it as "GPL/open source" is working from stale information.
- get-convex/convex-auth (179★) — no LICENSE file at all, 154 open issues, and Convex's own effort has visibly moved to the Better Auth component. Attractive because it's first-party; a trap because it's the deprecated path.
- Vaultwarden / Passbolt — both excellent, both the wrong shape. They manage human passwords, not application-level encrypted credentials.
- CaiJimmy/picsur — does not exist (404). The real repo is
CaramelFur/Picsur, 1,246★, AGPL-3.0. - Budibase / ToolJet / Appsmith as an "admin panel drop-in" — each is a whole second application with its own datastore and auth. They do not reduce your React LOC; they add a parallel system.
Corrections to the brief's assumptions
Four repos in the task list have moved or changed since the names were written: stack-auth/stack-auth → hexclave/hexclave; casbin/* → apache/casbin*; crater-invoice/crater → crater-invoice-inc/crater; and CaiJimmy/picsur does not exist. Two licences have changed under repos commonly cited as open source: Directus (now MSCL-1.0-GPL) and Vault (now BSL 1.1). Convex's own backend is FSL-1.1-Apache-2.0, not Apache-2.0 as the API's NOASSERTION might suggest — though the client libraries and all components genuinely are Apache-2.0.
One verification caveat, stated plainly: every row above came from a gh api repos/OWNER/NAME call except CaramelFur/Picsur, whose stars and licence I got from gh search repos — its last-push date is unverified. Everything else in the tables is directly verified.