From 02506d2a0f45b8302794a0e7c84052787fa12dd9 Mon Sep 17 00:00:00 2001
From: Sam Kim <sam@authzed.com>
Date: Tue, 5 Mar 2024 17:29:23 -0500
Subject: [PATCH 1/4] Re-enable page edit link

---
 theme.config.tsx | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/theme.config.tsx b/theme.config.tsx
index f230a799..e78b6f7c 100644
--- a/theme.config.tsx
+++ b/theme.config.tsx
@@ -119,7 +119,7 @@ const config: DocsThemeConfig = {
   primaryHue: { dark: 45, light: 290 },
   primarySaturation: { dark: 100, light: 100 },
   chat: { link: 'https://discord.gg/spicedb' },
-  docsRepositoryBase: 'https://github.com/authzed/docs',
+  docsRepositoryBase: 'https://github.com/authzed/docs/blob/main',
   banner: {
     dismissible: false,
     text: <Banner />,
@@ -140,7 +140,6 @@ const config: DocsThemeConfig = {
       </span>
     ),
   },
-  editLink: { text: null },
   toc: { backToTop: true, extraContent: <TocCTA /> },
   footer: {
     component: <Footer />,

From e8c2900305a4685ce677c566b18758ab0813589a Mon Sep 17 00:00:00 2001
From: Sam Kim <sam@authzed.com>
Date: Wed, 6 Mar 2024 15:17:17 -0500
Subject: [PATCH 2/4] Fix internal links

---
 pages/authzed/guides/picking-a-product.mdx    |   2 +-
 .../guides/setting-up-private-networking.mdx  |   2 +-
 pages/spicedb/concepts/caveats.mdx            |   4 +-
 .../spicedb/concepts/datastore-migrations.mdx |   4 +-
 pages/spicedb/concepts/datastores.mdx         |   4 +-
 pages/spicedb/concepts/dispatch.mdx           |   2 +-
 .../getting-started/discovering-spicedb.mdx   |   3 +-
 .../getting-started/protecting-a-blog.mdx     | 190 +++++++++---------
 pages/spicedb/modeling/representing-users.mdx |   2 +-
 .../ops/deploying-spicedb-operator.mdx        |   2 +-
 pages/spicedb/ops/load-testing.mdx            |   2 +-
 pages/spicedb/ops/observability.mdx           |   4 +-
 12 files changed, 110 insertions(+), 111 deletions(-)

diff --git a/pages/authzed/guides/picking-a-product.mdx b/pages/authzed/guides/picking-a-product.mdx
index 6039590a..0a737a49 100644
--- a/pages/authzed/guides/picking-a-product.mdx
+++ b/pages/authzed/guides/picking-a-product.mdx
@@ -131,7 +131,7 @@ The first 1 million of each are free.
 To understand and calculate your workloads' dispatches, you can refer to the documentation on [debugging requests][debug].
 
 [Serverless]: https://app.authzed.com/?utm_source=docs&utm_content=spicedb+serverless
-[debug]: ../../spicedb/ops/debugging-requests
+[debug]: /spicedb/modeling/validation-testing-debugging
 
 ### Open Source
 
diff --git a/pages/authzed/guides/setting-up-private-networking.mdx b/pages/authzed/guides/setting-up-private-networking.mdx
index 0d907fe1..58f1a7ea 100644
--- a/pages/authzed/guides/setting-up-private-networking.mdx
+++ b/pages/authzed/guides/setting-up-private-networking.mdx
@@ -87,7 +87,7 @@ desc = No schema has been defined; please call WriteSchema to start
 ```
 
 [zed]: https://github.com/authzed/zed
-[install-zed]: ../../spicedb/guides/installing-zed
+[install-zed]: /spicedb/getting-started/installing-zed
 
 </Steps>
 
diff --git a/pages/spicedb/concepts/caveats.mdx b/pages/spicedb/concepts/caveats.mdx
index f38c08e3..28886573 100644
--- a/pages/spicedb/concepts/caveats.mdx
+++ b/pages/spicedb/concepts/caveats.mdx
@@ -216,8 +216,8 @@ CheckPermissionRequest {
 
 The [Assertions] and [Expected Relations] definitions for validation of schema support caveats as well.
 
-[assertions]: /guides/schema#writing-assertions
-[expected relations]: /guides/schema#writing-expected-relations
+[assertions]: /spicedb/modeling/developing-a-schema#assertions
+[expected relations]: /spicedb/modeling/developing-a-schema#expected-relations
 
 ### Assertions
 
diff --git a/pages/spicedb/concepts/datastore-migrations.mdx b/pages/spicedb/concepts/datastore-migrations.mdx
index 298d0f14..017c27e7 100644
--- a/pages/spicedb/concepts/datastore-migrations.mdx
+++ b/pages/spicedb/concepts/datastore-migrations.mdx
@@ -15,7 +15,7 @@ For example, releases that include changes to datastore can require that users u
 
   To automate upgrades without downtime, consider deploying the [SpiceDB Operator].
 
-  [SpiceDB Operator]: /guides/deploying-spicedb-operator
+  [SpiceDB Operator]: /spicedb/concepts/operator
 </Callout>
 
 [SpiceDB GitHub releases page]: https://github.com/authzed/spicedb/releases
@@ -66,7 +66,7 @@ No matter which service you select, zero-downtime migrations are always performe
 If you are operating SpiceDB yourself, the recommended update workflow is to use the [SpiceDB Operator].
 Please see the [operator-specific update docs] for various update options.
 
-[operator-specific update docs]: /spicedb/operator#updating-managed-spicedbclusters
+[operator-specific update docs]: /spicedb/concepts/operator#updating-managed-spicedbclusters
 
 ### Sequential Updates
 
diff --git a/pages/spicedb/concepts/datastores.mdx b/pages/spicedb/concepts/datastores.mdx
index a594757d..ae61798c 100644
--- a/pages/spicedb/concepts/datastores.mdx
+++ b/pages/spicedb/concepts/datastores.mdx
@@ -91,7 +91,7 @@ In distributed systems, you can trade-off consistency for performance.
 
 CockroachDB datastore users that are willing to rely on more subtle guarantees to mitigate the [New Enemy Problem] can configure `--datastore-tx-overlap-strategy`.
 
-[New Enemy Problem]: /spicedb/concepts/new-enemy-problem
+[New Enemy Problem]: /spicedb/concepts/zanzibar#new-enemy-problem
 
 The available strategies are:
 
@@ -281,7 +281,7 @@ ALTER ZONE default CONFIGURE ZONE USING gc.ttlseconds = 90000;
   If you need an ephemeral datastore designed for validation or testing, see the test server system in [Validating and Testing]
 </Callout>
 
-[validating and testing]: /guides/validation-and-testing
+[validating and testing]: /spicedb/modeling/validation-testing-debugging
 
 ### Developer Notes
 
diff --git a/pages/spicedb/concepts/dispatch.mdx b/pages/spicedb/concepts/dispatch.mdx
index 2ca607e1..2901491c 100644
--- a/pages/spicedb/concepts/dispatch.mdx
+++ b/pages/spicedb/concepts/dispatch.mdx
@@ -28,7 +28,7 @@ If not using the [SpiceDB Operator], the `dispatch-upstream-addr` should be of t
 <Callout type="info">
   If you are deploying SpiceDB under Kubernetes, it is recommended to use the [SpiceDB Operator], which configures dispatching automatically.
 
-  [spicedb operator]: /spicedb/guides/deploying-spicedb-operator
+  [spicedb operator]: /spicedb/concepts/operator
 </Callout>
 
 ## Configuring Dispatch in non-Kubernetes Environments
diff --git a/pages/spicedb/getting-started/discovering-spicedb.mdx b/pages/spicedb/getting-started/discovering-spicedb.mdx
index 5eab03fc..b90f1f63 100644
--- a/pages/spicedb/getting-started/discovering-spicedb.mdx
+++ b/pages/spicedb/getting-started/discovering-spicedb.mdx
@@ -18,7 +18,7 @@ Welcome to the official documentation for the SpiceDB ecosystem.
 
 ## What is SpiceDB?
 
-SpiceDB is an open source, [Google Zanzibar]-inspired database system for real-time, security-critical [application permissions].
+SpiceDB is an open source, [Google Zanzibar]-inspired database system for real-time, security-critical application permissions.
 
 Developers create and apply a [schema] that models their application's resources and permissions.
 From their applications, [client libraries] are used to insert [relationships] or check permissions in their applications.
@@ -31,7 +31,6 @@ In some scenarios, SpiceDB can be challenging to operate because it is a critica
 For folks interested in a managed SpiceDB services and enterprise functionality, there are [AuthZed's products][authzed-products].
 
 [Google Zanzibar]: https://authzed.com/blog/what-is-zanzibar/
-[application permissions]: ./faq#what-are-application-permissions
 [schema]: https://authzed.com/docs/guides/schema
 [client libraries]: https://github.com/authzed/awesome-spicedb#clients
 [relationships]: ../concepts/relationships
diff --git a/pages/spicedb/getting-started/protecting-a-blog.mdx b/pages/spicedb/getting-started/protecting-a-blog.mdx
index 3cbeacd8..bd9bdba7 100644
--- a/pages/spicedb/getting-started/protecting-a-blog.mdx
+++ b/pages/spicedb/getting-started/protecting-a-blog.mdx
@@ -14,9 +14,9 @@ One of:
 - A [running instance] of [SpiceDB][SpiceDB] with the configured preshared key for SpiceDB
 
 [Authzed]: https://app.authzed.com
-[API Token]: /reference/api#authentication
+[API Token]: /authzed/concepts/restricted-api-access#tokens
 [SpiceDB]: https://github.com/authzed/spicedb
-[running instance]: /spicedb/installing
+[running instance]: /spicedb/getting-started/installing-spicedb
 
 ## Installation
 
@@ -128,11 +128,11 @@ With a schema designed, we can now move on using our client to to apply that sch
   <Tabs.Tab>
     ```js
     import { v1 } from '@authzed/authzed-node';
-    
+
     const { promises: client } = v1.NewClient(
       't_your_token_here_1234567deadbeef',
     );
-    
+
     const schema = `
     definition user {}
     definition post {
@@ -141,11 +141,11 @@ With a schema designed, we can now move on using our client to to apply that sch
 	    permission read = reader + writer
 	    permission write = writer
     }`;
-    
+
     const schemaRequest = v1.WriteSchemaRequest.create({
       schema: schema,
     });
-    
+
     const schemaResponse = await client.writeSchema(schemaRequest)
     console.log(schemaResponse)
     ```
@@ -154,18 +154,18 @@ With a schema designed, we can now move on using our client to to apply that sch
   <Tabs.Tab>
     ```go
     package main
-    
+
     import (
 	    "context"
 	    "log"
-    
+
 	    pb "github.com/authzed/authzed-go/proto/authzed/api/v1"
 	    "github.com/authzed/authzed-go/v1"
 	    "github.com/authzed/grpcutil"
 	    "google.golang.org/grpc"
 	    "google.golang.org/grpc/credentials/insecure"
     )
-    
+
     const schema = `definition user {}
     definition post {
 	    relation reader: user
@@ -173,15 +173,15 @@ With a schema designed, we can now move on using our client to to apply that sch
 	    permission read = reader + writer
 	    permission write = writer
     }`
-    
+
     const spicedbEndpoint = "grpc.authzed.com:443"
-    
+
     func main() {
 	    systemCerts, err := grpcutil.WithSystemCerts(grpcutil.VerifyCA)
 	    if err != nil {
 		    log.Fatalf("unable to load system CA certificates: %s", err)
 	    }
-    
+
 	    client, err := authzed.NewClient(
 		    spicedbEndpoint,
 		    grpcutil.WithBearerToken("t_your_token_here_1234567deadbeef"),
@@ -190,7 +190,7 @@ With a schema designed, we can now move on using our client to to apply that sch
 	    if err != nil {
 		    log.Fatalf("unable to initialize client: %s", err)
 	    }
-    
+
 	    request := &pb.WriteSchemaRequest{Schema: schema}
 	    _, err = client.WriteSchema(context.Background(), request)
 	    if err != nil {
@@ -204,7 +204,7 @@ With a schema designed, we can now move on using our client to to apply that sch
     ```py
     from authzed.api.v1 import Client, WriteSchemaRequest
     from grpcutil import bearer_token_credentials
-    
+
     SCHEMA = """definition user {}
     definition post {
         relation reader: user
@@ -212,10 +212,10 @@ With a schema designed, we can now move on using our client to to apply that sch
         permission read = reader + writer
         permission write = writer
     }"""
-    
+
     ENDPOINT = "grpc.authzed.com:443"
     CREDENTIALS = bearer_token_credentials("t_your_token_here_1234567deadbeef")
-    
+
     client = Client(ENDPOINT, CREDENTIALS)
     resp = client.WriteSchema(WriteSchemaRequest(schema=SCHEMA))
     ```
@@ -224,7 +224,7 @@ With a schema designed, we can now move on using our client to to apply that sch
   <Tabs.Tab>
     ```rb
     require 'authzed'
-    
+
     schema = <<~SCHEMA
         definition user {}
         definition post {
@@ -234,15 +234,15 @@ With a schema designed, we can now move on using our client to to apply that sch
           permission write = writer
         }
         SCHEMA
-    
+
     endpoint = 'grpc.authzed.com:443'
     credentials = Authzed::GrpcUtil::BearerToken.new(token: 't_your_token_here_1234567deadbeef')
-    
+
     client = Authzed::Api::V1::Client.new(
         target: endpoint,
         interceptors: [credentials],
     )
-    
+
     resp = client.schema_service.write_schema(
       Authzed::Api::V1::WriteSchemaRequest.new(schema: schema)
     )
@@ -255,18 +255,18 @@ With a schema designed, we can now move on using our client to to apply that sch
     import com.authzed.api.v1.SchemaServiceOuterClass.*;
     import com.authzed.grpcutil.BearerToken;
     import io.grpc.*;
-    
+
     public class App {
       public static void main(String[] args) {
         ManagedChannel channel = ManagedChannelBuilder
                 .forTarget("grpc.authzed.com:443")
                 .useTransportSecurity()
                 .build();
-    
+
         BearerToken bearerToken = new BearerToken("t_your_token_here_1234567deadbeef");
         SchemaServiceGrpc.SchemaServiceBlockingStub schemaService = SchemaServiceGrpc.newBlockingStub(channel)
                 .withCallCredentials(bearerToken);
-    
+
         String schema = """
                 definition user {}
                 definition post {
@@ -276,12 +276,12 @@ With a schema designed, we can now move on using our client to to apply that sch
                     permission write = writer
                 }
                 """;
-    
+
         WriteSchemaRequest request = WriteSchemaRequest
                 .newBuilder()
                 .setSchema(schema)
                 .build();
-    
+
         WriteSchemaResponse response;
         try {
           response = schemaService.writeSchema(request);
@@ -305,7 +305,7 @@ When applications modify or create rows in their database, they will also typica
   Writing relationships returns a [ZedToken] which is critical to ensuring performance and [consistency].
 </Callout>
 
-[ZedToken]: /spicedb/concepts/zedtokens
+[ZedToken]: /spicedb/concepts/consistency#zedtokens
 [consistency]: https://buf.build/authzed/api/docs/main:authzed.api.v1#authzed.api.v1.Consistency
 
 In the following example, we'll be creating two relationships: one making Emilia a writer of the first post and another making Beatrice a reader of the first post.
@@ -324,27 +324,27 @@ You can also [touch and delete] relationships, but those are not as immediately
   <Tabs.Tab>
     ```js
     import { v1 } from '@authzed/authzed-node';
-    
+
     const { promises: client } = v1.NewClient(
       't_your_token_here_1234567deadbeef',
       'grpc.authzed.com:50051',
     );
-    
+
     const resource = v1.ObjectReference.create({
       objectType: 'post',
       objectId: '1',
     });
-    
+
     const emilia = v1.ObjectReference.create({
       objectType: 'user',
       objectId: 'emilia',
     });
-    
+
     const beatrice = v1.ObjectReference.create({
       objectType: 'user',
       objectId: 'beatrice',
     });
-    
+
     const writeRequest = v1.WriteRelationshipsRequest.create({
       updates: [
         // Emilia is a Writer on Post 1
@@ -367,9 +367,9 @@ You can also [touch and delete] relationships, but those are not as immediately
         }),
       ],
     });
-    
+
     const response = await client.writeRelationships(writeRequest)
-    
+
     console.log(response)
     ```
   </Tabs.Tab>
@@ -377,30 +377,30 @@ You can also [touch and delete] relationships, but those are not as immediately
   <Tabs.Tab>
     ```go
     package main
-     
+
     import (
 	    "context"
 	    "fmt"
 	    "log"
-     
+
 	    pb "github.com/authzed/authzed-go/proto/authzed/api/v1"
 	    "github.com/authzed/authzed-go/v1"
 	    "github.com/authzed/grpcutil"
 	    "google.golang.org/grpc"
 	    "google.golang.org/grpc/credentials/insecure"
     )
-    
+
     const (
 	    spicedbEndpoint = "grpc.authzed.com:443"
 	    token = "t_your_token_here_1234567deadbeef"
     )
-     
+
     func main() {
 	    systemCerts, err := grpcutil.WithSystemCerts(grpcutil.VerifyCA)
 	    if err != nil {
 		    log.Fatalf("unable to load system CA certificates: %s", err)
 	    }
-     
+
 	    client, err := authzed.NewClient(
 		    spicedbEndpoint,
 		    grpcutil.WithBearerToken(token),
@@ -412,7 +412,7 @@ You can also [touch and delete] relationships, but those are not as immediately
 	    if err != nil {
 		    log.Fatalf("unable to initialize client: %s", err)
 	    }
-     
+
 	    request := &pb.WriteRelationshipsRequest{Updates: []*pb.RelationshipUpdate{
 		    { // Emilia is a Writer on Post 1
 			    Operation: pb.RelationshipUpdate_OPERATION_CREATE,
@@ -447,7 +447,7 @@ You can also [touch and delete] relationships, but those are not as immediately
 			    },
 		    },
 	    }}
-     
+
 	    resp, err := client.WriteRelationships(context.Background(), request)
 	    if err != nil {
 		    log.Fatalf("failed to write relations: %s", err)
@@ -468,12 +468,12 @@ You can also [touch and delete] relationships, but those are not as immediately
         WriteRelationshipsRequest,
     )
     from grpcutil import bearer_token_credentials
-    
+
     client = Client(
         "grpc.authzed.com:443",
         bearer_token_credentials("t_your_token_here_1234567deadbeef"),
     )
-    
+
     resp = client.WriteRelationships(
         WriteRelationshipsRequest(
             updates=[
@@ -508,7 +508,7 @@ You can also [touch and delete] relationships, but those are not as immediately
             ]
         )
     )
-    
+
     print(resp.written_at.token)
     ```
   </Tabs.Tab>
@@ -516,12 +516,12 @@ You can also [touch and delete] relationships, but those are not as immediately
   <Tabs.Tab>
     ```rb
     require 'authzed'
-    
+
     client = Authzed::Api::V1::Client.new(
       target: 'grpc.authzed.com:443',
       interceptors: [Authzed::GrpcUtil::BearerToken.new(token: 't_your_token_here_1234567deadbeef')],
     )
-    
+
     resp = client.permissions_service.write_relationships(
       Authzed::Api::V1::WriteRelationshipsRequest.new(
         updates: [
@@ -550,7 +550,7 @@ You can also [touch and delete] relationships, but those are not as immediately
         ]
       )
     )
-    
+
     puts resp.written_at.token
     ```
   </Tabs.Tab>
@@ -562,18 +562,18 @@ You can also [touch and delete] relationships, but those are not as immediately
     import com.authzed.grpcutil.BearerToken;
     import com.authzed.api.v1.Core.*;
     import io.grpc.*;
-    
+
     public class App {
       public static void main(String[] args) {
         ManagedChannel channel = ManagedChannelBuilder
                 .forTarget("grpc.authzed.com:443")
-                .useTransportSecurity()  
+                .useTransportSecurity()
                 .build();
-      
+
         BearerToken bearerToken = new BearerToken("t_your_token_here_1234567deadbeef");
         PermissionsServiceGrpc.PermissionsServiceBlockingStub permissionsService = PermissionsServiceGrpc.newBlockingStub(channel)
                 .withCallCredentials(bearerToken);
-    
+
         PermissionService.WriteRelationshipsRequest request = PermissionService.WriteRelationshipsRequest.newBuilder()
                 .addUpdates(
                         RelationshipUpdate.newBuilder()
@@ -597,7 +597,7 @@ You can also [touch and delete] relationships, but those are not as immediately
                                                 .build())
                                 .build())
                 .build();
-    
+
         PermissionService.WriteRelationshipsResponse response;
         try {
           response = permissionsService.writeRelationships(request);
@@ -626,8 +626,8 @@ For example, in our example schema, writers have both write and read, so there's
 <Callout type="warning">
   In order to get read-after-write consistency, you must provide a [ZedToken] from the WriteRelationships response or request [full consistency].
 
-  [ZedToken]: /spicedb/concepts/zedtokens
-  [full consistency]: /spicedb/concepts/zedtokens#what-happens-if-i-dont-use-a-zedtoken-at-all
+  [ZedToken]: /spicedb/concepts/consistency#zedtokens
+  [full consistency]: /spicedb/concepts/consistency#fully-consistent
 </Callout>
 
 The following examples demonstrate the transitive property of checks:
@@ -639,36 +639,36 @@ The following examples demonstrate the transitive property of checks:
     zed permission check post:1 write user:emilia   --revision "zedtokenfromwriterel" # true
     zed permission check post:1 read  user:beatrice --revision "zedtokenfromwriterel" # true
     zed permission check post:1 write user:beatrice --revision "zedtokenfromwriterel" # false
-    
+
     ```
   </Tabs.Tab>
 
   <Tabs.Tab>
     ```js
     import { v1 } from '@authzed/authzed-node';
-    
+
     const { promises: client } = v1.NewClient(
       't_your_token_here_1234567deadbeef',
       'grpc.authzed.com:50051',
       // NOTE: Remove if SpiceDB is behind TLS
       v1.ClientSecurity.INSECURE_PLAINTEXT_CREDENTIALS
     );
-    
+
     const resource = v1.ObjectReference.create({
       objectType: 'post',
       objectId: '1',
     });
-    
+
     const emilia = v1.ObjectReference.create({
       objectType: 'user',
       objectId: 'emilia',
     });
-    
+
     const beatrice = v1.ObjectReference.create({
       objectType: 'user',
       objectId: 'beatrice',
     });
-    
+
     const emiliaCanRead = await client.checkPermission(v1.CheckPermissionRequest.create({
       resource,
       permission: 'read',
@@ -677,7 +677,7 @@ The following examples demonstrate the transitive property of checks:
       }),
     }));
     console.log(emiliaCanRead.permissionship === v1.CheckPermissionResponse_Permissionship.HAS_PERMISSION);
-    
+
     const emiliaCanWrite = await client.checkPermission(v1.CheckPermissionRequest.create({
       resource,
       permission: 'write',
@@ -686,7 +686,7 @@ The following examples demonstrate the transitive property of checks:
       }),
     }));
     console.log(emiliaCanWrite.permissionship === v1.CheckPermissionResponse_Permissionship.HAS_PERMISSION);
-    
+
     const beatriceCanRead = await client.checkPermission(v1.CheckPermissionRequest.create({
       resource,
       permission: 'read',
@@ -695,7 +695,7 @@ The following examples demonstrate the transitive property of checks:
       }),
     }));
     console.log(beatriceCanRead.permissionship === v1.CheckPermissionResponse_Permissionship.HAS_PERMISSION);
-    
+
     const beatriceCanWrite = await client.checkPermission(v1.CheckPermissionRequest.create({
       resource,
       permission: 'write',
@@ -710,26 +710,26 @@ The following examples demonstrate the transitive property of checks:
   <Tabs.Tab>
     ```go
     package main
-    
+
     import (
 	    "context"
 	    "log"
-    
+
 	    pb "github.com/authzed/authzed-go/proto/authzed/api/v1"
 	    "github.com/authzed/authzed-go/v1"
 	    "github.com/authzed/grpcutil"
 	    "google.golang.org/grpc"
 	    "google.golang.org/grpc/credentials/insecure"
     )
-    
+
     const spicedbEndpoint = "grpc.authzed.com:443"
-    
+
     func main() {
 	    systemCerts, err := grpcutil.WithSystemCerts(grpcutil.VerifyCA)
 	    if err != nil {
 		    log.Fatalf("unable to load system CA certificates: %s", err)
 	    }
-    
+
 	    client, err := authzed.NewClient(
 		    spicedbEndpoint,
 		    grpcutil.WithBearerToken("t_your_token_here_1234567deadbeef"),
@@ -741,24 +741,24 @@ The following examples demonstrate the transitive property of checks:
 	    if err != nil {
 		    log.Fatalf("unable to initialize client: %s", err)
 	    }
-    
+
 	    ctx := context.Background()
-    
+
 	    emilia := &pb.SubjectReference{Object: &pb.ObjectReference{
 		    ObjectType: "user",
 		    ObjectId:  "emilia",
 	    }}
-    
+
 	    beatrice := &pb.SubjectReference{Object: &pb.ObjectReference{
 		    ObjectType: "user",
 		    ObjectId:  "beatrice",
 	    }}
-    
+
 	    firstPost := &pb.ObjectReference{
 		    ObjectType: "post",
 		    ObjectId: "1",
 	    }
-    
+
 	    resp, err := client.CheckPermission(ctx, &pb.CheckPermissionRequest{
 		    Resource: firstPost,
 		    Permission: "read",
@@ -768,7 +768,7 @@ The following examples demonstrate the transitive property of checks:
 		    log.Fatalf("failed to check permission: %s", err)
 	    }
 	    // resp.Permissionship == pb.CheckPermissionResponse_PERMISSIONSHIP_HAS_PERMISSION
-    
+
 	    resp, err = client.CheckPermission(ctx, &pb.CheckPermissionRequest{
 		    Resource: firstPost,
 		    Permission: "write",
@@ -778,7 +778,7 @@ The following examples demonstrate the transitive property of checks:
 		    log.Fatalf("failed to check permission: %s", err)
 	    }
 	    // resp.Permissionship == pb.CheckPermissionResponse_PERMISSIONSHIP_HAS_PERMISSION
-    
+
 	    resp, err = client.CheckPermission(ctx, &pb.CheckPermissionRequest{
 		    Resource: firstPost,
 		    Permission: "read",
@@ -788,7 +788,7 @@ The following examples demonstrate the transitive property of checks:
 		    log.Fatalf("failed to check permission: %s", err)
 	    }
 	    // resp.Permissionship == pb.CheckPermissionResponse_PERMISSIONSHIP_HAS_PERMISSION
-    
+
 	    resp, err = client.CheckPermission(ctx, &pb.CheckPermissionRequest{
 		    Resource: firstPost,
 		    Permission: "write",
@@ -812,12 +812,12 @@ The following examples demonstrate the transitive property of checks:
         SubjectReference,
     )
     from grpcutil import insecure_bearer_token_credentials
-    
+
     client = Client(
         "grpc.authzed.com:50051",
         insecure_bearer_token_credentials("t_your_token_here_1234567deadbeef"),
     )
-    
+
     emilia = SubjectReference(
         object=ObjectReference(
             object_type="user",
@@ -830,9 +830,9 @@ The following examples demonstrate the transitive property of checks:
             object_id="beatrice",
         )
     )
-    
+
     post_one = ObjectReference(object_type="post", object_id="1")
-    
+
     resp = client.CheckPermission(
         CheckPermissionRequest(
             resource=post_one,
@@ -841,7 +841,7 @@ The following examples demonstrate the transitive property of checks:
         )
     )
     assert resp.permissionship == CheckPermissionResponse.PERMISSIONSHIP_HAS_PERMISSION
-    
+
     resp = client.CheckPermission(
         CheckPermissionRequest(
             resource=post_one,
@@ -850,7 +850,7 @@ The following examples demonstrate the transitive property of checks:
         )
     )
     assert resp.permissionship == CheckPermissionResponse.PERMISSIONSHIP_HAS_PERMISSION
-    
+
     resp = client.CheckPermission(
         CheckPermissionRequest(
             resource=post_one,
@@ -859,7 +859,7 @@ The following examples demonstrate the transitive property of checks:
         )
     )
     assert resp.permissionship == CheckPermissionResponse.PERMISSIONSHIP_HAS_PERMISSION
-    
+
     resp = client.CheckPermission(
         CheckPermissionRequest(
             resource=post_one,
@@ -874,7 +874,7 @@ The following examples demonstrate the transitive property of checks:
   <Tabs.Tab>
     ```rb
     require 'authzed'
-    
+
     emilia = Authzed::Api::V1::SubjectReference.new(object: Authzed::Api::V1::ObjectReference.new(
       object_type: 'user',
       object_id: 'emilia',
@@ -884,13 +884,13 @@ The following examples demonstrate the transitive property of checks:
       object_id: 'beatrice',
     ))
     first_post = Authzed::Api::V1::ObjectReference.new(object_type: 'post', object_id: '1')
-    
+
     client = Authzed::Api::V1::Client.new(
         target: 'grpc.authzed.com:50051',
         interceptors: [Authzed::GrpcUtil::BearerToken.new(token: 't_your_token_here_1234567deadbeef')],
         credentials: :this_channel_is_insecure,
     )
-    
+
     resp = client.permissions_service.check_permission(Authzed::Api::V1::CheckPermissionRequest.new(
       resource: first_post,
       permission: 'read',
@@ -898,7 +898,7 @@ The following examples demonstrate the transitive property of checks:
     ))
     raise unless Authzed::Api::V1::CheckPermissionResponse::Permissionship.resolve(resp.permissionship) ==
       Authzed::Api::V1::CheckPermissionResponse::Permissionship::PERMISSIONSHIP_HAS_PERMISSION
-    
+
     resp = client.permissions_service.check_permission(Authzed::Api::V1::CheckPermissionRequest.new(
       resource: first_post,
       permission: 'write',
@@ -906,7 +906,7 @@ The following examples demonstrate the transitive property of checks:
     ))
     raise unless Authzed::Api::V1::CheckPermissionResponse::Permissionship.resolve(resp.permissionship) ==
       Authzed::Api::V1::CheckPermissionResponse::Permissionship::PERMISSIONSHIP_HAS_PERMISSION
-    
+
     resp = client.permissions_service.check_permission(Authzed::Api::V1::CheckPermissionRequest.new(
       resource: first_post,
       permission: 'read',
@@ -914,7 +914,7 @@ The following examples demonstrate the transitive property of checks:
     ))
     raise unless Authzed::Api::V1::CheckPermissionResponse::Permissionship.resolve(resp.permissionship) ==
       Authzed::Api::V1::CheckPermissionResponse::Permissionship::PERMISSIONSHIP_HAS_PERMISSION
-    
+
     resp = client.permissions_service.check_permission(Authzed::Api::V1::CheckPermissionRequest.new(
       resource: first_post,
       permission: 'write',
@@ -932,23 +932,23 @@ The following examples demonstrate the transitive property of checks:
     import com.authzed.grpcutil.BearerToken;
     import com.authzed.api.v1.Core.*;
     import io.grpc.*;
-    
+
     public class App {
       public static void main(String[] args) {
         ManagedChannel channel = ManagedChannelBuilder
                 .forTarget("grpc.authzed.com:50051")
-                .usePlaintext()  
+                .usePlaintext()
                 .build();
-      
+
         BearerToken bearerToken = new BearerToken("t_your_token_here_1234567deadbeef");
-    
+
         PermissionsServiceGrpc.PermissionsServiceBlockingStub permissionsService = PermissionsServiceGrpc.newBlockingStub(channel)
                 .withCallCredentials(bearerToken);
-    
+
         ZedToken zedToken = ZedToken.newBuilder()
                 .setToken("zed_token_value")
                 .build();
-    
+
         PermissionService.CheckPermissionRequest request = PermissionService.CheckPermissionRequest.newBuilder()
                 .setConsistency(
                         PermissionService.Consistency.newBuilder()
@@ -969,7 +969,7 @@ The following examples demonstrate the transitive property of checks:
                                 .build())
                 .setPermission("read")
                 .build();
-    
+
         PermissionService.CheckPermissionResponse response;
         try {
           response = permissionsService.checkPermission(request);
diff --git a/pages/spicedb/modeling/representing-users.mdx b/pages/spicedb/modeling/representing-users.mdx
index c8e71351..bbe6a722 100644
--- a/pages/spicedb/modeling/representing-users.mdx
+++ b/pages/spicedb/modeling/representing-users.mdx
@@ -95,7 +95,7 @@ definition document {
 }
 ```
 
-[wildcards]: /reference/schema-lang#wildcards
+[wildcards]: /spicedb/concepts/schema#wildcards
 
 <Callout type="info">
   It is recommended to use *wildcard* with an anonymous user definition if there is ever a need to differentiate between anonymous users based on their object IDs.
diff --git a/pages/spicedb/ops/deploying-spicedb-operator.mdx b/pages/spicedb/ops/deploying-spicedb-operator.mdx
index 27afef27..34a84624 100644
--- a/pages/spicedb/ops/deploying-spicedb-operator.mdx
+++ b/pages/spicedb/ops/deploying-spicedb-operator.mdx
@@ -119,7 +119,7 @@ desc = No schema has been defined; please call WriteSchema to start
 ```
 
 [zed]: https://github.com/authzed/zed
-[install-zed]: ./installing-zed
+[install-zed]: /spicedb/getting-started/installing-zed
 
 ### Taking things to production
 
diff --git a/pages/spicedb/ops/load-testing.mdx b/pages/spicedb/ops/load-testing.mdx
index c50c1dee..e810d31f 100644
--- a/pages/spicedb/ops/load-testing.mdx
+++ b/pages/spicedb/ops/load-testing.mdx
@@ -98,7 +98,7 @@ Subsequent requests (checks or lookups) that use the same revision and require a
 Therefore, every time a cached SpiceDB sub-problem is used, computation is avoided, load on the datastore is avoided, and a roundtrip to the datastore is avoided.
 You can read about cache configurations in the [configuration section][cs] below.
 
-[cs]: #spicedb-configuration-performance-considerations
+[cs]: #spicedb-configuration-performance
 
 ### SpiceDB Check Fanout Impact
 
diff --git a/pages/spicedb/ops/observability.mdx b/pages/spicedb/ops/observability.mdx
index af5270fd..c2730b6d 100644
--- a/pages/spicedb/ops/observability.mdx
+++ b/pages/spicedb/ops/observability.mdx
@@ -59,7 +59,7 @@ Here's a video walking through SpiceDB traces using [Jaeger]:
 
 [otel]: https://opentelemetry.io
 [tracing]: https://opentelemetry.io/docs/concepts/signals/traces/
-[global flags]: commands#global-flags
+[global flags]: /spicedb/concepts/commands#global-flags
 [Jaeger]: https://www.jaegertracing.io
 
 ## Structured Logging
@@ -123,7 +123,7 @@ Here's a comparison of the logs starting up a single SpiceDB v1.25 instance:
 </Tabs>
 
 [zerolog]: https://github.com/rs/zerolog
-[global flag]: commands#global-flags
+[global flag]: /spicedb/concepts/commands#global-flags
 [stdinouterr]: https://en.wikipedia.org/wiki/Standard_streams
 [NDJSON]: https://github.com/ndjson/ndjson-spec
 

From 1bd95fcc4dd13a43bda7a16c99ea823a27ea3117 Mon Sep 17 00:00:00 2001
From: Sam Kim <sam@authzed.com>
Date: Wed, 6 Mar 2024 15:34:15 -0500
Subject: [PATCH 3/4] Fix external links

---
 pages/spicedb/concepts/datastores.mdx                | 2 +-
 pages/spicedb/getting-started/installing-spicedb.mdx | 4 ++--
 pages/spicedb/links/_meta.json                       | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/pages/spicedb/concepts/datastores.mdx b/pages/spicedb/concepts/datastores.mdx
index ae61798c..384e7db7 100644
--- a/pages/spicedb/concepts/datastores.mdx
+++ b/pages/spicedb/concepts/datastores.mdx
@@ -139,7 +139,7 @@ ALTER ZONE default CONFIGURE ZONE USING gc.ttlseconds = 90000;
 
 [spanner-code]: https://github.com/authzed/spicedb/tree/main/internal/datastore/spanner
 [spanner-godoc]: https://pkg.go.dev/github.com/authzed/spicedb/internal/datastore/spanner
-[gc-process]: https://github.com/authzed/spicedb/blob/main/internal/datastore/spanner/gc.go
+[gc-process]: https://github.com/authzed/spicedb/blob/main/internal/datastore/common/gc.go
 
 ### Configuration
 
diff --git a/pages/spicedb/getting-started/installing-spicedb.mdx b/pages/spicedb/getting-started/installing-spicedb.mdx
index afa85b38..9343595b 100644
--- a/pages/spicedb/getting-started/installing-spicedb.mdx
+++ b/pages/spicedb/getting-started/installing-spicedb.mdx
@@ -9,13 +9,13 @@ However, one should prefer one of the recommended installation methods detailed
 <Callout type="info">
   Looking to deploy SpiceDB to a staging or production environment?
 
-  [Authzed Cloud] is the fastest and most production-ready way to deploy SpiceDB.
+  [Authzed Serverless] is the fastest and most production-ready way to deploy SpiceDB.
 
   Self-hosted installations should deploy the [SpiceDB Operator].
 
   There are also [community-maintained examples] for demo environments.
 
-  [Authzed Cloud]: https://authzed.cloud
+  [Authzed Serverless]: https://app.authzed.com
   [SpiceDB Operator]: /spicedb/ops/deploying-spicedb-operator
   [community-maintained examples]: https://github.com/authzed/examples
 </Callout>
diff --git a/pages/spicedb/links/_meta.json b/pages/spicedb/links/_meta.json
index 3029fc0b..752f2f38 100644
--- a/pages/spicedb/links/_meta.json
+++ b/pages/spicedb/links/_meta.json
@@ -11,7 +11,7 @@
   },
   "awesome-list": {
     "title": "SpiceDB Awesome List",
-    "href": "https://github.com/authzed/awesome-spicedb#awesome-spicedb",
+    "href": "https://github.com/authzed/awesome-spicedb#user-content-awesome-spicedb",
     "newWindow": true
   },
   "examples": {

From f307b8de4cd8329a5b1df64f36b6c8aefefd022a Mon Sep 17 00:00:00 2001
From: Sam Kim <sam@authzed.com>
Date: Wed, 6 Mar 2024 16:01:31 -0500
Subject: [PATCH 4/4] Replace lychee with linkcheck

---
 .github/workflows/link-checker-full.yaml | 19 +++++++++++++++++++
 .github/workflows/link-checker.yaml      |  8 ++++----
 linkcheck-skip.txt                       |  5 +++++
 3 files changed, 28 insertions(+), 4 deletions(-)
 create mode 100644 .github/workflows/link-checker-full.yaml
 create mode 100644 linkcheck-skip.txt

diff --git a/.github/workflows/link-checker-full.yaml b/.github/workflows/link-checker-full.yaml
new file mode 100644
index 00000000..658c2d23
--- /dev/null
+++ b/.github/workflows/link-checker-full.yaml
@@ -0,0 +1,19 @@
+---
+name: "Link Checker with External Links"
+
+on:
+  schedule:
+    - cron: '0 10 * * *' # Daily at 10
+  workflow_dispatch:
+
+jobs:
+  link_checker:
+    name: "Link Checker"
+    runs-on: "ubuntu-latest"
+    timeout-minutes: 15
+    steps:
+      - uses: "actions/checkout@v3"
+      - name: "Link Checker"
+        uses: "filiph/linkcheck@3.0.0"
+        with:
+          arguments: "--skip-file /github/workspace/linkcheck-skip.txt -e https://authzed.com/docs"
diff --git a/.github/workflows/link-checker.yaml b/.github/workflows/link-checker.yaml
index c469dd21..8c294567 100644
--- a/.github/workflows/link-checker.yaml
+++ b/.github/workflows/link-checker.yaml
@@ -1,5 +1,5 @@
 ---
-name: "Link Checker (Fail Fast)"
+name: "Link Checker"
 
 on:
   push:
@@ -20,6 +20,7 @@ jobs:
           token: "${{ secrets.GITHUB_TOKEN }}"
           check_interval: 30
           max_timeout: 600
+          allow_inactive: true
 
   link_checker:
     name: "Link Checker"
@@ -29,7 +30,6 @@ jobs:
     steps:
       - uses: "actions/checkout@v3"
       - name: "Link Checker"
-        uses: "lycheeverse/lychee-action@v1.9.0"
+        uses: "filiph/linkcheck@3.0.0"
         with:
-          fail: true
-          args: "--verbose --no-progress --exclude '^https://github.com/.*.mdx' ${{ needs.preview.outputs.preview_url }}"
+          arguments: "--skip-file /github/workspace/linkcheck-skip.txt ${{ needs.preview.outputs.preview_url }}"
diff --git a/linkcheck-skip.txt b/linkcheck-skip.txt
new file mode 100644
index 00000000..24a5bed2
--- /dev/null
+++ b/linkcheck-skip.txt
@@ -0,0 +1,5 @@
+.*/_next/.*
+https://authzed.com/zanizbar/.*
+https://pkg.go.dev/.*
+https://pprof.me
+https://www.researchgate.net/profile/Carrie-Gates-2/publication/240787391_Access_Control_Requirements_for_Web_20_Security_and_Privacy/links/540e6f670cf2d8daaacd4adf/Access-Control-Requirements-for-Web-20-Security-and-Privacy.pdf