Merge branch 'main' into codex/clarify-team-ownership-model

Author: fforootd

.changeset/README.md

@@ -27,6 +27,8 @@ Pick the affected packages, the bump type (patch / minor / major), and write a o
 The repo is currently in changesets **prerelease mode** with the `alpha` tag (see `.changeset/pre.json`). While in this mode:
 
 - `changeset version` cuts versions like `0.1.0-alpha.0`, `0.1.0-alpha.1`, …
+- Public packages are in one fixed group, so an alpha train uses the same
+  version across `@zitadel/cli`, SDKs, components, and generated API packages.
 - `changeset publish` publishes them under the **`alpha`** npm dist-tag, **not** `latest`. So `npm install @zitadel/cli` keeps resolving the last stable release; consumers opt into prereleases with `@zitadel/cli@alpha`.
 - A package that has never had a stable release is published to `latest` on its first publish (changesets behaviour), then to `alpha` thereafter until it has a stable release.
 
@@ -57,7 +59,14 @@ short-lived OIDC credentials, but npm only accepts public provenance
 attestations from public source repositories. Re-enable provenance when
 `zitadel/nextgen` is public.
 
-The Go server binary is **not** managed by changesets — it is released with `goreleaser` through the manual [`release.yml`](../.github/workflows/release.yml) workflow while the repo is pre-release. See [docs/adrs/002-multi-package-release-strategy.md](../docs/adrs/002-multi-package-release-strategy.md).
+Changesets does not build the Go server binary. During alpha, `release-npm.yml`
+uses the lockstep npm version as the release train version, creates `v<version>`,
+and then runs GoReleaser so the server image and binaries publish into the same
+GitHub Release. The manual [`release.yml`](../.github/workflows/release.yml)
+workflow remains a server snapshot/fallback path. See
+[docs/adrs/002-multi-package-release-strategy.md](../docs/adrs/002-multi-package-release-strategy.md)
+and
+[docs/adrs/023-lockstep-alpha-release-train.md](../docs/adrs/023-lockstep-alpha-release-train.md).
 
 ## Licensing reminder
 

.changeset/api-config-global-slot.md

@@ -0,0 +1,5 @@
+---
+"@zitadel/api": patch
+---
+
+Fix `configureZitadel()` so its state survives when more than one copy of `@zitadel/api/config` ends up loaded — the standalone components bundle inlines its own copy, and dual-package hazards / duplicate `node_modules` trees in a monorepo can load a second copy alongside the app's. Previously each module instance held its own `let currentProject`, so a `configureZitadel()` call in one was invisible to `getZitadelConfig()` in another and the components silently saw no config. The slot now lives on `globalThis` under a `Symbol.for(...)` key, which the global symbol registry resolves to the same symbol identity in every copy of the module evaluated in the same JS realm — separate realms (iframes, Node `vm` contexts, worker threads) still have their own registries.

.changeset/components-declarative-config.md

@@ -0,0 +1,7 @@
+---
+"@zitadel/components": minor
+---
+
+Allow configuring `<zitadel-login>` and `<zitadel-logout>` declaratively from HTML via `project-id`, `proxy-path`, and `url` attributes, so the components work on a plain page without JS or `configureZitadel()`. Configuration resolves in this order, highest first: the `project` property, then the `configureZitadel()` global, then the HTML attributes. The existing JS paths still win — the attributes are the no-JS fallback.
+
+Also fix the standalone bundle so it loads in a browser: it was built for Node and emitted an `import "node:module"` that browsers cannot resolve. It is now built for the browser, so `dist/standalone.mjs` is genuinely self-contained.

.changeset/components-standalone-bundle.md

@@ -0,0 +1,5 @@
+---
+"@zitadel/components": minor
+---
+
+Add a standalone browser bundle (`dist/standalone.mjs`) so the components work on a plain HTML page via `<script type="module">` with no import map or bundler. Exposed via the `./standalone` export and `unpkg`/`jsdelivr`.

.changeset/config.json

@@ -2,7 +2,19 @@
   "$schema": "https://unpkg.com/@changesets/config@latest/schema.json",
   "changelog": ["@changesets/changelog-github", { "repo": "zitadel/nextgen" }],
   "commit": false,
-  "fixed": [],
+  "fixed": [
+    [
+      "@zitadel/cli",
+      "@zitadel/api",
+      "@zitadel/components",
+      "@zitadel/sdk-core",
+      "@zitadel/sdk-next",
+      "@zitadel/sdk-nuxt",
+      "@zitadel/sdk-react",
+      "@zitadel/sdk-vue",
+      "@zitadel/sdk-angular"
+    ]
+  ],
   "linked": [],
   "access": "public",
   "baseBranch": "main",

.changeset/lockstep-alpha-train.md

@@ -0,0 +1,5 @@
+---
+"@zitadel/cli": patch
+---
+
+Derive alpha local runtime images from the installed CLI version, pin generated SDK dependencies to the same alpha train, and emit exact-version follow-up commands for reproducible tester reports.

.changeset/pre.json

@@ -28,18 +28,25 @@
   "changesets": [
     "add-spa-sdks",
     "align-alpha-sdk-dependency",
+    "api-config-global-slot",
     "cli-drop-unused-flows",
     "cli-remove-claim-logic",
     "cli-scaffold-middleware",
     "cli-server-owned-schema-flow",
     "components-atoms-and-orchestrator",
+    "components-audit-lit-tidy",
+    "components-declarative-config",
     "components-orval-wireup",
     "components-replace-ui-lit-placeholders",
+    "components-standalone-bundle",
     "consumer-journey-credential-flow",
     "design-tokens-and-ui-react",
     "fix-cli-nx-ci",
     "fix-release-pnpm-setup",
+    "lockstep-alpha-train",
     "passkey-end-to-end-flow",
+    "quiet-doctor-scaffold",
+    "register-profile-field-labels",
     "slow-lines-grin",
     "smooth-playwright-journey",
     "soft-local-dev",

.changeset/register-profile-field-labels.md

@@ -0,0 +1,6 @@
+---
+"@zitadel/components": patch
+---
+
+Add English labels for the `givenName`, `familyName`, and `dateOfBirth`
+fields the default register step now collects.

.changeset/try-depot-runners.md

@@ -0,0 +1,4 @@
+---
+---
+
+Try Depot Ubuntu 24.04 runners for GitHub Actions workflows.

.github/instructions/consumer-journey.instructions.md

@@ -12,7 +12,7 @@ demo-app e2e suite.
 - Produce package artifacts with `corepack pnpm --dir <package> pack` and keep
   tarball verification for required package presence plus unresolved
   `catalog:` or `workspace:` dependency specs.
-- Pack only the six public Zitadel packages. Private support packages such as
+- Pack only the public Zitadel packages. Private support packages such as
   design tokens must not be uploaded or published to Verdaccio.
 - Keep Verdaccio proxying npmjs for third-party dependencies while publishing
   Zitadel tarballs under both `alpha` and `latest`.