docs(authzed): product-availability pill on concept pages; Audit Logging self-hosted section framed as SpiceDB Enterprise

app/_meta.ts

@@ -33,4 +33,7 @@ export default {
   changes: {
     display: "hidden",
   },
+  review: {
+    display: "hidden",
+  },
 } satisfies MetaRecord;

app/authzed/concepts/audit-logging/page.mdx

@@ -7,7 +7,8 @@ import { Callout, Tabs } from "nextra/components";
 
 # Audit Logging
 
-Audit Logging is functionality exclusive to AuthZed products that publishes logs of SpiceDB API operations to a log sink.
+Audit Logging publishes logs of SpiceDB API operations to a log sink.
+It ships with AuthZed Cloud, Dedicated, and Enterprise; SpiceDB open source does not include it.
 
 ## Log Format
 
@@ -171,25 +172,31 @@ The process for setting up audit logging varies depending on the AuthZed product
 
 Using the web dashboard, navigate to the Permission System's settings page to find the Audit Log settings.
 
-### Self-Hosted
+### SpiceDB Enterprise (self-hosted) [#self-hosted]
+
+<Callout type="warning">
+  **AuthZed Enterprise only.** The `--extender-audit-*` flags below are flags on `spicedb serve` in
+  the AuthZed-licensed SpiceDB Enterprise binary. They are not present in [SpiceDB open
+  source](/authzed/guides/picking-a-product#open-source), which has no audit logging.
+</Callout>
 
 Use the following command-line flags:
 
-| Flag                                             | Description                                                                                                                                                          | Default   |
-| ------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------- |
-| --extender-enabled                               | must be set to`authzed-audit`                                                                                                                                        |           |
-| --extender-audit-batch-size-limit                | defines the maximum number of audit events to be processed as a unit                                                                                                 | `10000`   |
-| --extender-audit-buffer-size                     | defines the size of the audit log buffer that holds events to be processed by workers                                                                                | `1000000` |
-| --extender-audit-buffer-window                   | defines maximum amount of time events are buffered before being pushed                                                                                               | `1s`      |
-| --extender-audit-disabled-on-methods strings     | list of comma-separated, fully-qualified API methods to disable events for. Watch API is always excluded (e.g. `/authzed.api.v1.PermissionsService/CheckPermission`) |           |
-| --extender-audit-initial-retry-interval duration | sets the first retry backoff in case of a failure to push audit events to the backend                                                                                | `1s`      |
-| --extender-audit-max-retry-interval duration     | sets the maximum backoff duration in case of failure to push events                                                                                                  | `30s`     |
-| --extender-audit-retry-randomizer-factor         | sets the randomization factor for the backoff duration - this helps prevent thundering herds on event push errors                                                    | `0.5`     |
-| --extender-audit-stream-name                     | defines the name of the target stream/topic (e.g. Kafka Topic, Kinesis Stream...)                                                                                    | `spicedb` |
-| --extender-audit-target-configuration            | target-type specific configuration                                                                                                                                   | `[]`      |
-| --extender-audit-target-endpoint-url string      | defines the URL of target endpoint to ingest audit events. If left unspecified, some types will try to determine automatically (e.g. AWS SDK)                        |           |
-| --extender-audit-target-type                     | defines the type of target to ingest audit events                                                                                                                    | `noop`    |
-| --extender-audit-worker-count                    | defines the number of worker goroutines to process audit events (default 5)                                                                                          |           |
+| Flag                                               | Description                                                                                                                                                          | Default   |
+| -------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------- |
+| `--extender-enabled`                               | must be set to `authzed-audit`                                                                                                                                       |           |
+| `--extender-audit-batch-size-limit`                | defines the maximum number of audit events to be processed as a unit                                                                                                 | `10000`   |
+| `--extender-audit-buffer-size`                     | defines the size of the audit log buffer that holds events to be processed by workers                                                                                | `1000000` |
+| `--extender-audit-buffer-window`                   | defines maximum amount of time events are buffered before being pushed                                                                                               | `1s`      |
+| `--extender-audit-disabled-on-methods` strings     | list of comma-separated, fully-qualified API methods to disable events for. Watch API is always excluded (e.g. `/authzed.api.v1.PermissionsService/CheckPermission`) |           |
+| `--extender-audit-initial-retry-interval` duration | sets the first retry backoff in case of a failure to push audit events to the backend                                                                                | `1s`      |
+| `--extender-audit-max-retry-interval` duration     | sets the maximum backoff duration in case of failure to push events                                                                                                  | `30s`     |
+| `--extender-audit-retry-randomizer-factor`         | sets the randomization factor for the backoff duration - this helps prevent thundering herds on event push errors                                                    | `0.5`     |
+| `--extender-audit-stream-name`                     | defines the name of the target stream/topic (e.g. Kafka Topic, Kinesis Stream...)                                                                                    | `spicedb` |
+| `--extender-audit-target-configuration`            | target-type specific configuration                                                                                                                                   | `[]`      |
+| `--extender-audit-target-endpoint-url` string      | defines the URL of target endpoint to ingest audit events. If left unspecified, some types will try to determine automatically (e.g. AWS SDK)                        |           |
+| `--extender-audit-target-type`                     | defines the type of target to ingest audit events                                                                                                                    | `noop`    |
+| `--extender-audit-worker-count`                    | defines the number of worker goroutines to process audit events (default 5)                                                                                          |           |
 
 ### Tokens in Audit Logs
 

app/authzed/concepts/private-networking/page.mdx

@@ -7,7 +7,7 @@ import { Callout } from "nextra/components";
 
 # Private Networking
 
-Private Networking is functionality exclusive to AuthZed Dedicated that restricts network access to internal networks.
+Private Networking restricts network access to internal networks.
 When enabled, connections that are not configured are rejected.
 
 By adding this additional layer of security, entire classes of security risk are eliminated because only trusted networks have access to the software powering your authorization systems.

app/authzed/concepts/restricted-api-access/page.mdx

@@ -7,7 +7,8 @@ import { Callout, Tabs } from "nextra/components";
 
 # Restricted API Access
 
-Restricted API Access is functionality exclusive to AuthZed products that restricts access to SpiceDB for API Tokens.
+Restricted API Access restricts access to SpiceDB for API Tokens.
+It ships with AuthZed Cloud, Dedicated, and Enterprise; SpiceDB open source does not include it.
 
 This functionality enables organizations to apply the principle of least-privilege to services accessing SpiceDB.
 For example, read-only tokens can be created for services that should never need to write to SpiceDB.
@@ -209,15 +210,31 @@ The process for setting up this feature varies depending on the AuthZed product
 
 Using the web dashboard, navigate to the Permission System's "Access" tab.
 
-### Self-Hosted
+### SpiceDB Enterprise (self-hosted) [#self-hosted]
+
+<Callout type="warning">
+  **AuthZed Enterprise only.** The `--extender-*` flags below are flags on `spicedb serve` in the
+  AuthZed-licensed SpiceDB Enterprise binary. They are not present in [SpiceDB open
+  source](/authzed/guides/picking-a-product#open-source), so passing them to the open source
+  `spicedb` fails with an unknown-flag error.
+</Callout>
+
+For example:
+
+```sh
+spicedb serve \
+  --grpc-preshared-key "<your-key>" \
+  --extender-enabled authzed-fgam \
+  --extender-authzed-fgam-endpoint file:///etc/spicedb/fgam.yaml
+```
 
 Use the following command-line flags:
 
-| Flag                                  | Description                                                                                                                                                                           | Default |
-| ------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- |
-| --extender-authzed-fgam-endpoint      | defines the external SpiceDB endpoint used to authorize operations for the authzed-fgam extender. If a file:// endpoint is provided, server is run embedded with static configuration |         |
-| --extender-authzed-fgam-preshared-key | defines the external SpiceDB preshared key used to authorize operations for the authzed-fgam extender. Ignored if endpoint is local (file://)                                         |         |
-| --extender-enabled                    | must be set to `authzed-fgam`                                                                                                                                                         |         |
+| Flag                                    | Description                                                                                                                                                                           | Default |
+| --------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- |
+| `--extender-authzed-fgam-endpoint`      | defines the external SpiceDB endpoint used to authorize operations for the authzed-fgam extender. If a file:// endpoint is provided, server is run embedded with static configuration |         |
+| `--extender-authzed-fgam-preshared-key` | defines the external SpiceDB preshared key used to authorize operations for the authzed-fgam extender. Ignored if endpoint is local (file://)                                         |         |
+| `--extender-enabled`                    | must be set to `authzed-fgam`                                                                                                                                                         |         |
 
 If you set `--extender-authzed-fgam-endpoint` to a file, it must be a YAML configuration file.
 

app/authzed/concepts/workload-isolation/page.mdx

@@ -7,7 +7,7 @@ import YouTube from "@/components/youtube-wrapper";
 
 # Workload Isolation
 
-Workload Isolation is functionality exclusive to AuthZed products by which we give your SpiceDB deployments access to hardware that is only used by you, to guarantee performance and prevent "noisy neighbor" problems.
+Workload Isolation gives your SpiceDB deployments access to hardware that is only used by you, to guarantee performance and prevent "noisy neighbor" problems.
 
 ## Control Plane
 

app/globals.css

@@ -289,3 +289,150 @@ html.dark-mode {
     display: inline-flex;
   }
 }
+
+/* ── Tables ─────────────────────────────────────────────────────────────────
+   Nextra's default MDX table is a full grid: 1px borders on every cell, zebra
+   rows, 16px body text, generous padding. On reference tables (flag lists,
+   feature matrices) that reads as a spreadsheet and fights the page. This
+   restyles every markdown table to horizontal rules only, a quiet mono
+   header row, and slightly smaller type, in the same register as the
+   Feature Matrix and the web comparison tables. Unlayered so it wins over
+   Nextra's `x:` utilities without !important. */
+
+.nextra-content table,
+article table {
+  --tbl-rule: hsl(280 5% 84%);
+  --tbl-head-rule: hsl(280 6% 60%);
+  --tbl-hover: hsl(300 8% 96%);
+  --tbl-head: hsl(280 4% 44%);
+  font-size: 0.875rem;
+  line-height: 1.5;
+  border-collapse: collapse;
+}
+html.dark .nextra-content table,
+html.dark article table {
+  --tbl-rule: hsl(279 9% 22%);
+  --tbl-head-rule: hsl(279 8% 40%);
+  --tbl-hover: hsl(279 12% 11%);
+  --tbl-head: hsl(280 4% 58%);
+}
+
+.nextra-content table tr,
+article table tr {
+  border: 0;
+  border-bottom: 1px solid var(--tbl-rule);
+  background: transparent;
+}
+.nextra-content table thead tr,
+article table thead tr {
+  border-bottom: 1px solid var(--tbl-head-rule);
+}
+.nextra-content table tbody tr:last-child,
+article table tbody tr:last-child {
+  border-bottom: 1px solid var(--tbl-head-rule);
+}
+.nextra-content table tbody tr:hover,
+article table tbody tr:hover {
+  background: var(--tbl-hover);
+}
+
+.nextra-content table th,
+.nextra-content table td,
+article table th,
+article table td {
+  border: 0;
+  padding: 0.55rem 0.75rem;
+  vertical-align: top;
+  text-align: left;
+}
+.nextra-content table th:first-child,
+.nextra-content table td:first-child,
+article table th:first-child,
+article table td:first-child {
+  padding-left: 0.25rem;
+}
+.nextra-content table th:last-child,
+.nextra-content table td:last-child,
+article table th:last-child,
+article table td:last-child {
+  padding-right: 0.25rem;
+}
+
+/* Header row: mono, small, tracked, muted. A label, not a bold sentence. */
+.nextra-content table th,
+article table th {
+  padding-top: 0.25rem;
+  padding-bottom: 0.5rem;
+  font-family: var(--font-mono, ui-monospace, monospace);
+  font-size: 0.7rem;
+  font-weight: 500;
+  letter-spacing: 0.1em;
+  text-transform: uppercase;
+  color: var(--tbl-head);
+}
+
+/* Centered columns (Feature Matrix) keep their alignment from the markdown. */
+.nextra-content table th[style*="text-align: center"],
+.nextra-content table td[style*="text-align: center"],
+article table th[style*="text-align: center"],
+article table td[style*="text-align: center"] {
+  text-align: center;
+}
+
+/* First column is the row's identifier: keep it from collapsing, break it only
+   at a hyphen or space. Long code values (connection URIs) may break anywhere
+   rather than push the table sideways. */
+.nextra-content table td:first-child,
+article table td:first-child {
+  min-width: 11rem;
+  overflow-wrap: normal;
+}
+.nextra-content table td code,
+.nextra-content table td code.nextra-code,
+article table td code,
+article table td code.nextra-code {
+  font-size: 0.8em;
+  white-space: normal;
+  /* word-break, not overflow-wrap: Nextra's own `code.nextra-code` rule pins
+     overflow-wrap to break-word, which does not shrink a cell's min-content,
+     so a long URI would still push the table sideways. */
+  word-break: break-word;
+}
+/* Trailing column is usually a short value (default, type). A floor keeps
+   `1000000` on one line while a long URI in the same slot still wraps. */
+.nextra-content table td:last-child,
+article table td:last-child {
+  min-width: 6rem;
+}
+
+/* ── Callouts ───────────────────────────────────────────────────────────────
+   Nextra colours its <Callout> with stock Tailwind hues (yellow-700 text on
+   yellow-50, blue-700 on blue-100, …), none of which are Sandworm. Re-key each
+   type to the site's own tokens, in the same tint/border/ink recipe the
+   product and feature pills use: 10% tint, 50% border, full-strength ink.
+   Types are matched on Nextra's own background class since the component
+   exposes no type attribute. */
+
+.nextra-callout {
+  --co: var(--blue-500);
+  background: hsl(var(--co) / 0.1);
+  border-color: hsl(var(--co) / 0.5);
+  color: hsl(var(--co));
+}
+.nextra-callout[class*="x:bg-yellow-"] {
+  --co: var(--sand-300);
+}
+.nextra-callout[class*="x:bg-red-"] {
+  --co: var(--red-400);
+}
+.nextra-callout[class*="x:bg-green-"] {
+  --co: var(--teal-500);
+}
+.nextra-callout[class*="x:bg-purple-"] {
+  --co: var(--violet-500);
+}
+/* Light mode: the tokens are mid-lightness, so ink needs to be darker than
+   the border to keep body text readable on the tint. */
+html:not(.dark) .nextra-callout {
+  color: hsl(from hsl(var(--co)) h s calc(l - 10));
+}

app/materialize/api/client-sdks/page.mdx

@@ -5,8 +5,6 @@ description: "SDK versions with generated gRPC and protobuf support for the Auth
 
 # Client SDKs
 
-<FeatureBadge />
-
 All SpiceDB SDKs have the generated gRPC and protobuf code
 
 - [authzed-go v0.15.0](https://github.com/authzed/authzed-go/releases/tag/v0.15.0)

app/materialize/api/download-permission-sets/page.mdx

@@ -7,8 +7,6 @@ import { Callout } from "nextra/components";
 
 # DownloadPermissionSets
 
-<FeatureBadge />
-
 For large datasets, `DownloadPermissionSets` is a faster alternative to [LookupPermissionSets] for the initial [backfill](../concepts/permission-set-lifecycle): instead of streaming individual events over a single connection, it hands you a manifest of files you can fetch directly from blob storage, in parallel.
 
 ## Request

app/materialize/api/lookup-permission-sets/page.mdx

@@ -7,8 +7,6 @@ import { Callout } from "nextra/components";
 
 # LookupPermissionSets
 
-<FeatureBadge />
-
 This API complements [WatchPermissionSets].
 When you first bring on a system that needs permissions data, [LookupPermissionSets] lets you create an initial snapshot of the permissions data, and then you can use the [WatchPermissionSets] API to keep the snapshot updated.
 

app/materialize/api/watch-permission-sets/page.mdx

@@ -7,8 +7,6 @@ import { Callout } from "nextra/components";
 
 # WatchPermissionSets
 
-<FeatureBadge />
-
 This is an update stream of all the permissions Materialize is configured to watch.
 You can use this to store all permissions tracked in the system closer to your application database to be used in database-native ACL filtering.
 Permissions can also be stored in secondary indexes like Elasticsearch.