Changelog

Functional changes to the Food Truck API, newest first. Backfilled from git history on 2026-10-23.

2026-10-23

When to use Zuplo

  • New architecture decision page When to use Zuplo: FTN does not need the gateway today; it is parked until FTN offers a public or partner API. Search moves to a Convex action and trucks and check-ins move to Convex.

API docs and portal cleanup

  • The API reference is titled "Food Truck API" and every route has a summary and description.

  • The portal introduction describes the real API in place of the template text.

  • Auth0 sign-in support was removed from the portal; the portal stays public.

  • Gateway environment variables are documented, and env.example lists them.

  • New API endpoints page.

  • Fixed the "Missing environment variables" error text in Google search.

Developer portal moved to Zudoku

  • The API developer portal now runs on Zuplo’s Zudoku-based Dev Portal at its own zuplo.site domain, replacing the legacy portal that Zuplo shut down on 2025-11-15.

  • The portal shows the introduction page and the API reference generated from config/routes.oas.json.

  • The portal is public; sign-in and API-key self-serve are off.

2026-10-06

Dependabot for GitHub Actions

  • Monthly grouped updates for workflow actions.

2026-10-05

Encoding guard

  • CI check rejects UTF-8 mojibake.

2026-04-11

Biome and dprint formatting

  • Added Biome and dprint configuration and a shared .vscode workspace.

2026-01-26

Docs moved to docs/

  • The Antora component now lives at docs/ instead of docs/antora/.

2025-12-06

Antora documentation

  • Documentation migrated to an Antora component.

2025-10-11

Switched to pnpm

  • pnpm replaces npm; package-lock.json removed.

2025-08-02

Corepack and pnpm setup

  • Package manager pinned through corepack, with setup instructions.

2025-07-12

Consistent line endings

  • .gitattributes normalizes line endings across macOS and Windows.

2025-03-10

JWT authentication and CORS

  • Login callback issues HS256 JWTs signed with @tsndr/cloudflare-worker-jwt.

  • CORS policy allows configured client origins, including local development.

  • Session cookies derive the client origin from request headers.

  • Business info endpoint logs unauthenticated requests.

2025-03-09

Cross-site session cookies

  • Session cookies support cross-site sharing, with relaxed flags on localhost.

2025-03-08

Initial API

  • Zuplo gateway project with routes.

  • Food truck check-in endpoint backed by Firebase/Firestore.

  • Endpoint listing food trucks within geographic bounds.

  • Google OAuth login and business info endpoints.