CRATEFIELD
Source Early access

Managed backend · Rust modules · One database per tenant

A managed backend in Rust.
Fits almost every app.

Pick the modules your product needs. They compile into one backend with its own database, and we run it: builds, migrations, secrets, domains, monitoring. Your backend is a Cargo.toml, the core is MIT, and the exit is documented. The managed service is in early access.

Request early access Read the source

The fieldmodules → one binary

acme_backend.wasmone backend · one database · operated
MITRust, wasm3210 crates~15k lines200+ testsclippy -D warningscargo denywasm build in CI#![forbid(unsafe_code)]

Harness Shipping

The open-source core.

Ten Rust crates, MIT. A Module trait, a builder, ports, adapters, a CLI and a conformance kit. It is what the codebase calls itself: you harness parts you didn't build. Readable on GitHub today.

Cratefield Planned

The managed service.

We would build your composition, provision the database, apply migrations, hold the secrets, attach your domain and keep it running. That is what you would pay for. It is not built yet, and early access is early access. What it would cover.

The composition

One file wires the whole backend.

Real, from the repository, unedited. Each .module() is a crate. Each .runtime() call supplies an adapter for a port. Swap Resend for another mailer, or the hosted runtime for a native binary, and the modules do not change.

That is the whole composition. If a module needs a port the runtime doesn't provide, this doesn't compile.

examples/acme/src/harness.rs · SHIPPING 
Harness::builder()
    .venture(Venture::new("acme", "acme.com")
        .public_url("https://acme.com")
        .cors_origins(["https://acme.com"]))
    .module(EmailSignup::new().double_opt_in(true))
    .module(Waitlist::new().products(["alpha"]))
    .runtime(Cloudflare::new()
        .db("DB")
        .mailer(Resend::from_env())
        .captcha(Turnstile::from_env()))
    .build()?

Request lifecycle · Shipping

requestHTTPS
axum router/v1/<name>
modulecrate
porttrait object
adapterruntime-cloudflare
D1your account

The argument

A backend you compile, not a platform you configure. Operated by us, and yours to take with you.

01

Modules are crates, composed at compile time.

A backend lists module crates in Cargo.toml and wires them in one file. The binary contains exactly those modules. Harness::build() refuses a module that needs a port the runtime doesn't provide, two modules claiming the same route prefix or table, or a module built against a different contract version. Misconfiguration fails cargo test, not production.

02

Managed end to end, and reversible.

Cratefield would run the parts nobody wants to run: builds, migrations, secrets, domains, certificates and monitoring. What it would not do is trap you. The composition file and the Cargo manifest are yours, the core is MIT, and the same modules run as a native binary you host yourself. Leaving is a deploy, not a migration project.

03

Isolation is the database boundary, not a policy language.

Every tenant gets its own database. Never schema-per-tenant, never shared tables, no search_path switching, no row level security to get wrong. Migration history, secrets and audit log live inside that database, so backup, restore, move and offboarding are one-database operations with no blast radius.

04

Portability is architectural, not a promise.

Modules never touch a vendor client, a platform binding or an environment variable. They receive trait objects and adapters answer. CI builds the example backend to wasm32 every commit: a dependency pulling tokio, mio or std::fs fails the build. MIT, not BSL.

05

Stateless by construction, at the edge.

Rust compiled to WebAssembly and served at the edge. No static mut, no thread-local outliving a request, no session store. Request scope travels in axum extensions, and the conformance kit ships the concurrent-request test that proves it.

—

Changing modules is a deploy.

Toggling a module regenerates Cargo.toml and harness.rs, rebuilds Rust to wasm and redeploys. Tens of seconds to minutes, with a build log. There is no instant config flip, and we won't draw one.

What this does not do

The limits, as numbers.

Read these before the comparison. Full version on the comparison page.

  • D1 is SQLite, not Postgres. No pgvector, no extensions, no LISTEN/NOTIFY. 10 GB per database, a hard cap Cloudflare does not raise. Single-threaded: throughput tracks query duration, roughly 1,000 queries/sec at 1 ms, about 10/sec at 100 ms.
  • No realtime, no object storage, no dashboard data browser yet.
  • The control plane does not exist yet. Not a line of it. Early access is early access.
  • What to do about it. The Database port already accepts real Postgres, and self-hosting is the documented exit: the same modules run as a native binary. Both are Designed, not Shipping.

Status

What is merged, what is specified, what is only named.

Present tense is earned. Only Shipping rows describe code that exists; everything else links to the issue that specifies it, or says plainly that it is not started.

Shippingmerged, tested, in the public repo Designedspecified in public issues, unbuilt Plannednamed, unspecified

Every Harness and Cratefield capability with its current status and evidence.
Capability What it is Status Evidence
Harness coreModule trait, Harness builder, ports, problem+json errors, request scope, event bus, template registryShippingcrates/core
Cloudflare runtimeD1, KV, rate limiting, wait_until mapped to portsShippingcrates/runtime-cloudflare
AdaptersResend, Turnstile, SQLiteShippingcrates/
Modulesemail-signup, waitlistShippingmodules/
fz CLI, conformance kit, contract versioningCI: fmt, clippy -D warnings, tests, cargo deny, worker-build --releaseShipping.github/workflows
Postgres adapter, native runtimeSame modules as a native binary; the self-hosting exitDesigned#18–#21
Auth servicePasskeys, Google, Apple, Meta, password, magic links, OAuth 2.1 + PKCE, ES256 JWTs with JWKSDesigned22 issues
Secrets, KMS, auditTwo-tier secrets, envelope encryption, KMS trait, tamper-evident audit log, key rotationDesigned#23, #24
Cratefield control planeProvisioning into your account, builds, deploys, log forwardingPlannednot started
Hosted on our accountWorkers for Platforms, dispatch namespacesPlannednot started
Published cratesNothing on crates.io yet; depend on the git repositoryPlannedcrates.io

The service

You would be paying for the operating, not the licence.

The code is MIT and always will be. What a fee buys is the work around it: generating the manifest, building Rust to wasm, applying migrations in order, holding secrets, attaching your domain, renewing its certificate, streaming the logs back. All of it is Planned, and none of it is running yet.

The intended launch price is $19 per backend per month, flat: unlimited egress, unlimited custom domains, 10 GB of storage and 10 million requests included. It is not purchasable yet and it can still move. The pricing page shows the arithmetic behind it, next to what Supabase, Railway and Firebase charge.

  • Manifest and composition file generated from the modules you pick
  • Rust built to wasm on every change, with a readable build log
  • Database created, forward-only migrations applied in order
  • Secrets held, signing keys rotated, both kept out of the logs
  • Your domain attached and its certificate renewed
  • Request spans and logs forwarded back to you

Managed · Planned

Request early access

An email and, optionally, what you run today. We reply when there is something to deploy into your account. Nothing else gets sent.

Request early access

Open source · Shipping

Read the source

15,281 lines of Rust across 10 crates, MIT. No email required to read documentation.

github.com/Factory-Zero/harness