docs: point SPA production guidance at ADR 036 instead of @zitadel/edge-proxy - #561
Open
fforootd wants to merge 7 commits into
Open
docs: point SPA production guidance at ADR 036 instead of @zitadel/edge-proxy#561fforootd wants to merge 7 commits into
fforootd wants to merge 7 commits into
Conversation
…ge-proxy The edge-proxy package was decided against in ADR 036 (#552) and its PR closed (#56); main still documented it as the production path in patcher docs, SDK package READMEs (with import examples of a package that does not exist on npm), and the docs site. Point everything at the decided model — platform rewrite or minimal worker plus the publishable key — and the tracking issue #560, stating clearly that until that work lands the dev proxy covers local development only.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Contributor
🦋 Changeset detectedLatest commit: 7033284 The changes in this PR will be included in the next version bump. This PR includes changesets to release 20 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates SPA production proxy guidance across the SDK READMEs, docs site, and CLI patcher docs to align with ADR 036 (credential planes) and remove references to the abandoned/nonexistent @zitadel/edge-proxy package.
Changes:
- Replace
@zitadel/edge-proxyproduction guidance in SPA SDK READMEs with ADR 036’s model (platform rewrite/minimal worker; no secrets on the platform). - Update the docs site to link production SPA proxy guidance to the “SDK proxy” concept page and add an explicit “SPAs in production” section there.
- Add a changeset to publish the updated README content for the six SPA SDK packages.
Reviewed changes
Copilot reviewed 20 out of 20 changed files in this pull request and generated 7 comments.
Show a summary per file
| File | Description |
|---|---|
| packages/sdk-vue/README.md | Remove @zitadel/edge-proxy example; point production guidance at ADR 036 + #560. |
| packages/sdk-svelte/README.md | Same as above for Svelte SDK README. |
| packages/sdk-solid/README.md | Same as above for Solid SDK README. |
| packages/sdk-react/README.md | Same as above for React SDK README. |
| packages/sdk-qwik/README.md | Same as above for Qwik SDK README. |
| packages/sdk-angular/README.md | Update Angular SDK README production proxy guidance to ADR 036 model. |
| apps/docs/content/docs/sdks/react.mdx | Update production step to point to SDK proxy concept page. |
| apps/docs/content/docs/concepts/sdk-proxy.mdx | Add “SPAs in production” section describing platform rewrite/worker approach and current tracking status. |
| apps/cli/src/lib/orca/patchers/rule/vue/README.md | Update patcher documentation to remove edge-proxy guidance and reference ADR 036 + #560. |
| apps/cli/src/lib/orca/patchers/rule/svelte/README.md | Same update for Svelte patcher docs. |
| apps/cli/src/lib/orca/patchers/rule/svelte/index.ts | Update inline comment to remove edge-proxy mention and reference ADR 036 + #560. |
| apps/cli/src/lib/orca/patchers/rule/solid/README.md | Same update for Solid patcher docs. |
| apps/cli/src/lib/orca/patchers/rule/solid/index.ts | Update inline comment to remove edge-proxy mention and reference ADR 036 + #560. |
| apps/cli/src/lib/orca/patchers/rule/react/README.md | Same update for React patcher docs. |
| apps/cli/src/lib/orca/patchers/rule/react/index.ts | Update inline comment to remove edge-proxy mention and reference ADR 036 + #560. |
| apps/cli/src/lib/orca/patchers/rule/qwik/README.md | Same update for Qwik patcher docs. |
| apps/cli/src/lib/orca/patchers/rule/qwik/index.ts | Update inline comment to remove edge-proxy mention and reference ADR 036 + #560. |
| apps/cli/src/lib/orca/patchers/rule/angular/README.md | Same update for Angular patcher docs. |
| apps/cli/src/lib/orca/patchers/rule/angular/index.ts | Update inline comment to remove edge-proxy mention and reference ADR 036 + #560. |
| .changeset/sdk-readme-adr036-docs.md | Patch changeset for the six SPA SDK packages so README updates publish to npm. |
…m-neutral wording Add an explicit 'until that work lands, production SPA deployment is not yet supported' caveat to all six SDK package READMEs, and make the docs-site credential wording mechanism-neutral: docs/design/api/ credentials.md specifies an origin-bound challenge nonce where ADR 036 says publishable key, and public docs should not take sides while that divergence is arbitrated (flagged on #560).
17 tasks
# Conflicts: # apps/cli/src/lib/orca/patchers/rule/angular/README.md # apps/cli/src/lib/orca/patchers/rule/qwik/README.md # apps/cli/src/lib/orca/patchers/rule/react/README.md # apps/cli/src/lib/orca/patchers/rule/solid/README.md # apps/cli/src/lib/orca/patchers/rule/svelte/README.md # apps/cli/src/lib/orca/patchers/rule/vue/README.md
fforootd
marked this pull request as ready for review
August 3, 2026 12:16
fforootd
enabled auto-merge (squash)
August 4, 2026 10:26
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
@zitadel/edge-proxypackage and feat: edge proxy with project-secret injection, scaffolded by the CLI #56 is closed — but main still documented that package as the SPA production path in three places: the six framework patcher docs/READMEs, the six SDK package READMEs (includingimport { handleProxy } from '@zitadel/edge-proxy'examples for a package that does not exist on npm), and the docs site./__nextgenpath comes from a platform rewrite (vercel.json/netlify.toml) or a minimal Cloudflare worker, combined with the publishable key from ADR 036 — no secrets in platform env stores. Every touched passage links ADR 036 and the tracking issue SPA deploy UX: implement ADR 036 credential planes (publishable key, secretless platform deploys) #560, and states that until that work lands the dev proxy covers local development only.concepts/sdk-proxy.mdxgains an "SPAs in production" section (the SDK pages' "how to run one in production" links previously pointed at a page that never said).Validation
grep -rn "edge-proxy" apps/cli/src packages/sdk-*/README.md apps/docs/content— zero matches after the change.Release notes / changeset
.changeset/sdk-readme-adr036-docs.md— patch for the six SPA SDK packages (published README content changed; no shipped behavior changed).Notes
POST /sessions/exchange, recorded as an implementation note in ADR 036); full removal from the SPA path remains W3c of SPA deploy UX: implement ADR 036 credential planes (publishable key, secretless platform deploys) #560.