docs: sync Actor, platform, and API documentation

redirects.mjs

@@ -66,9 +66,7 @@ const explicitRedirects = {
 	'/integrations/containers': '/integrations/',
 	'/integrations/unity': '/integrations/',
 	'/integrations/godot': '/integrations/',
-	// Endpoints was rewritten as the shorter Connect page; Runtime Modes folded
-	// into Nodes & Node Pools.
-	'/docs/endpoints': '/docs/connect/',
+	// Runtime Modes folded into Nodes & Node Pools.
 	'/docs/runtime-modes': '/docs/nodes/',
 	// Dead links inside dated changelog posts. Neither target ever existed, so
 	// these point at the nearest real page rather than being rewritten in the
@@ -97,10 +95,8 @@ const explicitRedirects = {
 	// split credentials (Overview, JWTs, ACL) from in-Actor authorization.
 	'/actors/docs/access-control': '/actors/docs/permissions/',
 	'/docs/actors/access-control': '/actors/docs/permissions/',
-	// Credential docs are platform-wide, so they live in the General bundle
-	// rather than the Actors one.
-	'/actors/docs/authentication': '/docs/authentication/',
-	'/docs/actors/authentication': '/docs/authentication/',
+	// Legacy Actor authentication URLs point to the restored Actor-specific page.
+	'/docs/actors/authentication': '/actors/docs/authentication/',
 	'/actors/docs/jwt': '/docs/jwt/',
 	'/docs/actors/ephemeral-variables': '/actors/docs/state/',
 	'/docs/actors/persistence': '/actors/docs/state/',
@@ -132,6 +128,10 @@ const explicitRedirects = {
 	'/docs/cloud/api/actors/create': '/actors/docs/',
 	'/docs/cloud/api/routes/update': '/actors/docs/',
 	'/docs/cloud/self-hosting/single-container': '/docs/deploy/self-host/control-plane/',
+	// Retired quickstart and gateway routes keep their existing inbound links.
+	'/actors/docs/quickstart/next-js': '/actors/docs/quickstart/react/',
+	'/docs/actors/quickstart/next-js': '/actors/docs/quickstart/react/',
+	'/docs/api/gateway/request': '/docs/api/',
 	// Next.js client redirect (linked from homepage)
 	'/docs/clients/next-js': '/actors/docs/clients/javascript/',
 	// Self-hosting redirect
@@ -437,8 +437,7 @@ function bundleSplitRedirects() {
 	map['/actors/use-cases'] = '/actors/docs/';
 	map['/actors/learn/a-radically-simpler-architecture'] =
 		'/guides/a-radically-simpler-architecture/';
-	// The AI Agent guide was retired for the Agents docs and their guides.
-	map['/guides/ai-agent'] = '/guides/personal-agent/';
+	// Preserve the older learning-page link to the personal-agent guide.
 	map['/actors/learn/ai-agent'] = '/guides/personal-agent/';
 	return map;
 }
@@ -457,25 +456,16 @@ function agentosIntegrationsRedirects() {
 	return map;
 }
 
-// Retired pages and the page that replaced each. The serverless node
-// platforms are gone. Workers & Pools became Nodes & Node Pools, which absorbed
-// Pool Configuration. Statuses, Regions and the control plane Troubleshooting
-// page were removed for their closest replacements. The control plane Access
-// Control and Performance pages are covered by Scoped Tokens and Benchmarking.
-// Per-product copies of the self-host slugs redirect too.
+// Retired deployment and product pages point to their current replacements.
+// Restored documentation pages keep their own routes.
 const RETIRED_PAGES = {
 	'/docs/deploy/self-host/workers/vercel': '/docs/deploy/self-host/nodes/',
 	'/docs/deploy/self-host/workers/cloudflare': '/docs/deploy/self-host/nodes/',
 	'/docs/deploy/self-host/workers/gcp-cloud-run': '/docs/deploy/self-host/nodes/',
 	'/docs/deploy/self-host/workers/aws-lambda': '/docs/deploy/self-host/nodes/',
 	'/docs/deploy/self-host/workers/supabase': '/docs/deploy/self-host/nodes/',
 	'/docs/deploy/self-host/workers/freestyle': '/docs/deploy/self-host/nodes/',
-	'/docs/workers': '/docs/nodes/',
-	'/docs/pool-configuration': '/docs/nodes/',
 	'/docs/runtime-modes': '/docs/nodes/',
-	'/docs/statuses': '/actors/docs/lifecycle/',
-	'/docs/regions': '/docs/architecture/',
-	'/docs/troubleshooting': '/actors/docs/troubleshooting/',
 	'/actors/docs/inspector-tabs': '/actors/docs/debugging/',
 	'/docs/deploy/self-host/control-plane/rbac': '/docs/jwt/',
 	'/docs/deploy/self-host/control-plane/performance': '/docs/benchmarking/',

vendor/actors/docs/content/docs/actions.mdx

@@ -24,7 +24,7 @@ Nest actions to group related behavior:
 
 <CodeSnippet file="examples/docs/actors-actions/nested-actions.ts" />
 
-Clients use the same path, such as `handle.users.add("Ada")`. Low-level APIs and the Inspector use the dot-separated action name `users.add`.
+Clients use the same path, such as `handle.users.add("Ada")`. Low-level APIs use the dot-separated action name `users.add`.
 
 ## Calling Actions
 
@@ -37,13 +37,6 @@ Actions can be called in different ways depending on your use case:
 
 Learn more about [communicating with actors from the frontend](/actors/docs/communicating-between-actors).
 
-</Tab>
-<Tab title="Backend (registry.handler)">
-
-<CodeSnippet file="examples/docs/actors-actions/calling-backend.ts" title="server.ts" />
-
-Learn more about [communicating with actors from the backend](/actors/docs/communicating-between-actors).
-
 </Tab>
 <Tab title="Actor-to-Actor (c.client())">
 
@@ -127,13 +120,3 @@ Rivet provides the `ActionContextOf` utility type for exactly this purpose:
 <CodeSnippet file="examples/docs/actors-actions/action-context.ts" />
 
 See [types](/actors/docs/types) for more details on using `ActionContextOf` and other utility types.
-
-{/* TODO(code): restore when the control plane exposes an API to read an Actor's inspector token. Tracked in ACT-6493.
-
-## Debugging
-
-- `GET /inspector/rpcs` lists all available actions on an actor.
-- `POST /inspector/action/:name` executes an action with JSON args and returns output.
-- In non-dev mode, inspector endpoints require authorization.
-
-*/}

vendor/actors/docs/content/docs/appearance.mdx

@@ -1,10 +1,10 @@
 ---
 title: Icons & Names
-description: "Configure display names and icons for Rivet Actors so each instance is easy to recognize in the inspector."
+description: "Configure display names and icons for Rivet Actors so each instance is easy to recognize in the Rivet dashboard."
 skill: true
 ---
 
-Actors can be customized with a display name and icon that appear in the Rivet inspector. This helps identify actors at a glance when managing your application.
+Actors can be customized with a display name and icon that appear in the Rivet dashboard. This helps identify actors at a glance when managing your application.
 
 ## Configuration
 
@@ -50,7 +50,7 @@ Users can then use this directly:
 
 <CodeSnippet file="examples/docs/actors-appearance/run-handler-usage.ts" />
 
-This run-handler metadata is applied through the registry metadata. The native runtime and inspector config read the actor's `options.name` and `options.icon` directly, so set those explicitly if you need the name or icon to appear everywhere.
+This run-handler metadata is applied through the registry metadata. The native runtime reads the actor's `options.name` and `options.icon` directly, so set those explicitly if you need the name or icon to appear everywhere.
 
 Actor-level `options.name` and `options.icon` always take precedence, allowing users to override library defaults:
 

vendor/actors/docs/content/docs/authentication.mdx

@@ -0,0 +1,129 @@
+---
+title: "Authentication"
+description: "Authenticate Rivet Actor connections, validate credentials before clients connect, and carry trusted identity into actor actions."
+skill: true
+---
+
+## Do You Need Authentication?
+
+<Tabs>
+<Tab title="Rivet Cloud">
+	Actors are private by default on Rivet Cloud. Only requests with the publishable token can interact with actors.
+
+	- **Backend-only actors**: If your publishable token is only included in your backend, then authentication is not necessary.
+	- **Frontend-accessible actors**: If your publishable token is included in your frontend, then implementing authentication is recommended.
+</Tab>
+<Tab title="Self-Hosted">
+	Control plane authentication is required by default on self-hosted Rivet. Configure an admin token on the control plane and issue scoped tokens for clients.
+
+	See [Authentication](/docs/authentication) for credentials and [Scoped Tokens](/docs/jwt) for permissions.
+</Tab>
+</Tabs>
+
+## Issue access tokens
+
+Keep the control plane's admin credential on your backend. Issue [scoped tokens](/docs/jwt) for clients, granting only the resources and operations they need in their namespace. Actor traffic uses `actor_gateway` permissions; Actor creation and lookup use `actor` permissions.
+
+Control plane grants decide which Actors a client can reach. The connection hooks below can also check your application's user identity and permissions.
+
+## Authentication Connections
+
+Authentication is configured through either:
+
+- `onBeforeConnect` for simple pass/fail validation
+- `createConnState` when you need to access user data in your actions via `c.conn.state`
+
+## Access Control
+
+After a connection is authenticated, use [Access Control](/actors/docs/access-control) to enforce authorization:
+
+- Check permissions in action handlers.
+- Use `queues.<name>.canPublish` to gate inbound queue publishes.
+- Use `events.<name>.canSubscribe` to gate event subscriptions.
+
+### `onBeforeConnect`
+
+The `onBeforeConnect` hook validates credentials before allowing a connection. Throw an error to reject the connection.
+
+<CodeSnippet file="examples/docs/actors-permissions/on-before-connect.ts" />
+
+### `createConnState`
+
+Use `createConnState` to extract user data from credentials and store it in connection state. This data is accessible in actions via `c.conn.state`. Like `onBeforeConnect`, throwing an error will reject the connection. See [connections](/actors/docs/connections) for more details.
+
+<CodeSnippet file="examples/docs/actors-permissions/create-conn-state.ts" />
+
+## Available Auth Data
+
+Authentication hooks have access to several properties:
+
+| Property | Description |
+|----------|-------------|
+| `params` | Custom data passed by the client when connecting (see [connection params](/actors/docs/connections#extracting-data-from-connection-params)) |
+| `c.request` | The underlying HTTP request object |
+| `c.request.headers` | Request headers for tokens, API keys (does not work for `.connect()`) |
+| `c.state` | Actor state for authorization decisions (see [state](/actors/docs/state)) |
+| `c.key` | The actor's key (see [keys](/actors/docs/keys)) |
+
+It's recommended to use `params` instead of `c.request.headers` whenever possible since it works for both HTTP & WebSocket connections.
+
+## Client Usage
+
+### Passing Credentials
+
+Pass authentication data when connecting. Use `getParams` when you need a fresh JWT for every connection or reconnect:
+
+<CodeGroup>
+<CodeSnippet file="examples/docs/actors-permissions/passing-credentials-connection.ts" title="Connection" />
+<CodeSnippet file="examples/docs/actors-permissions/passing-credentials-stateless.ts" title="Stateless-Action" />
+<CodeSnippet file="examples/docs/actors-permissions/passing-credentials-headers.ts" title="HTTP-Headers" />
+</CodeGroup>
+
+### Handling Errors
+
+Authentication errors use the same system as regular errors. See [errors](/actors/docs/errors) for more details.
+
+<CodeGroup>
+<CodeSnippet file="examples/docs/actors-permissions/handling-errors-connection.ts" title="Connection" />
+<CodeSnippet file="examples/docs/actors-permissions/handling-errors-stateless.ts" title="Stateless-Action" />
+</CodeGroup>
+
+## Examples
+
+### JWT
+
+Validate JSON Web Tokens and extract user claims:
+
+<CodeSnippet file="examples/docs/actors-permissions/jwt.ts" />
+
+### External Auth Provider
+
+Validate credentials against an external authentication service:
+
+<CodeSnippet file="examples/docs/actors-permissions/external-auth-provider.ts" />
+
+### Using `c.state` In Authorization
+
+Access actor state via `c.state` and the actor's key via `c.key` to make authorization decisions:
+
+<CodeSnippet file="examples/docs/actors-permissions/using-state.ts" />
+
+### Role-Based Access Control
+
+Create helper functions for common authorization patterns:
+
+<CodeSnippet file="examples/docs/actors-permissions/role-based-access-control.ts" />
+
+### Rate Limiting
+
+Use `c.vars` to track connection attempts and rate limit by user:
+
+<CodeSnippet file="examples/docs/actors-permissions/rate-limiting.ts" />
+
+The limits in this example are [ephemeral](/actors/docs/state#ephemeral-variables). If you wish to persist rate limits, you can optionally replace `vars` with `state`.
+
+### Caching Tokens
+
+Cache validated tokens in `c.vars` to avoid redundant validation on repeated connections. See [ephemeral variables](/actors/docs/state#ephemeral-variables) for more details.
+
+<CodeSnippet file="examples/docs/actors-permissions/caching-tokens.ts" />

vendor/actors/docs/content/docs/clients/javascript.mdx

@@ -41,6 +41,8 @@ Use `params` for static connection parameters. Use `getParams` when the value ca
 
 <CodeSnippet file="examples/docs/clients-javascript/connection-lifecycle.ts" />
 
+Transient connection failures trigger reconnection. Actions rejected during a disconnect are removed from the outbound queue; a request already sent can have an unknown outcome. Use application-level idempotency before retrying mutations. A permanent connection-opening failure rejects subsequent calls on that connection; create a new connection after correcting the cause.
+
 ## Low-Level HTTP & WebSocket
 
 For actors that implement `onRequest` or `onWebSocket`, call them directly:
@@ -100,7 +102,7 @@ Endpoints support URL auth syntax:
 https://namespace:token@rivet.example.com
 ```
 
-You can also pass the endpoint without auth and provide `RIVET_NAMESPACE` and `RIVET_TOKEN` separately. See [Endpoints](/docs/connect#url-auth-syntax) for details.
+You can also pass the endpoint without auth and provide `RIVET_NAMESPACE` and `RIVET_TOKEN` separately. See [Endpoints](/docs/endpoints#url-auth-syntax) for details.
 
 ## Advanced
 

vendor/actors/docs/content/docs/clients/react.mdx

@@ -102,7 +102,7 @@ Endpoints support URL auth syntax:
 https://namespace:token@rivet.example.com
 ```
 
-You can also pass the endpoint without auth and provide `RIVET_NAMESPACE` and `RIVET_TOKEN` separately. See [Endpoints](/docs/connect#url-auth-syntax) for details.
+You can also pass the endpoint without auth and provide `RIVET_NAMESPACE` and `RIVET_TOKEN` separately. See [Endpoints](/docs/endpoints#url-auth-syntax) for details.
 
 ## API Reference