zudoku 0.82.2 → 0.82.4

package/dist/cli/worker.js

@@ -2617,6 +2617,25 @@ var AuthenticationSchema = z4.discriminatedUnion("type", [
     authorizationParams: z4.record(z4.string(), z4.string()).optional(),
     forwardAuthorizationParams: z4.array(z4.string()).optional()
   }),
+  z4.object({
+    type: z4.literal("entra"),
+    basePath: z4.string().optional(),
+    clientId: z4.string(),
+    // Tenant id or one of Entra's multi-tenant authorities
+    // (common/organizations/consumers). Defaults to "common".
+    tenantId: z4.string().optional(),
+    // Full issuer override, e.g. for CIAM tenants on *.ciamlogin.com.
+    issuer: z4.string().optional(),
+    audience: z4.string().optional(),
+    scopes: z4.array(z4.string()).optional(),
+    redirectToAfterSignUp: z4.string().optional(),
+    redirectToAfterSignIn: z4.string().optional(),
+    redirectToAfterSignOut: z4.string().optional(),
+    signUp: SignUpOpenIdSchema.optional(),
+    disableSignUp: z4.boolean().optional(),
+    authorizationParams: z4.record(z4.string(), z4.string()).optional(),
+    forwardAuthorizationParams: z4.array(z4.string()).optional()
+  }),
   z4.object({
     type: z4.literal("azureb2c"),
     basePath: z4.string().optional(),
@@ -2921,6 +2940,7 @@ var renderPage = async ({ urlPath }) => {
       outputPath,
       redirect: { from: pathname, to: redirectTo },
       statusCode: response.status,
+      indexStatusCode: response.status,
       html: ""
     };
   }
@@ -2931,6 +2951,7 @@ var renderPage = async ({ urlPath }) => {
   }
   const fileContent = response.body ? await response.text() : "";
   let html = fileContent;
+  let indexStatusCode = response.status;
   if (isProtectedRoute) {
     const bypassRequest = new Request(url);
     const bypassResponse = await server.handleRequest({
@@ -2946,12 +2967,14 @@ var renderPage = async ({ urlPath }) => {
       );
     }
     html = bypassResponse.body ? await bypassResponse.text() : "";
+    indexStatusCode = bypassResponse.status;
   }
   await fs.mkdir(path.dirname(outputPath), { recursive: true });
   await fs.writeFile(outputPath, fileContent);
   return {
     outputPath,
     statusCode: response.status,
+    indexStatusCode,
     redirect: void 0,
     html
   };

package/dist/declarations/app/wrapProtectedRoutes.d.ts

@@ -1,4 +1,9 @@
 import type { RouteObject } from "react-router";
 import type { ProtectedRoutesInput } from "../config/validators/ProtectedRoutesSchema.js";
 export declare const wrapProtectedRoutes: (routes: RouteObject[], protectedRoutes: ProtectedRoutesInput, isAuthenticated: boolean, basePath?: string) => RouteObject[];
+export declare const wrapProtectedRoutesForRender: (routes: RouteObject[], protectedRoutes: ProtectedRoutesInput, { isAuthenticated, bypassProtection, basePath, }: {
+    isAuthenticated: boolean;
+    bypassProtection?: boolean;
+    basePath?: string;
+}) => RouteObject[];
 export declare const warnInlineProtectedRoutes: (routes: RouteObject[], protectedRoutes: ProtectedRoutesInput, basePath?: string) => void;

package/dist/declarations/config/config.d.ts

@@ -22,3 +22,6 @@ export type FirebaseAuthenticationConfig = Extract<AuthenticationConfig, {
 export type AzureB2CAuthenticationConfig = Extract<AuthenticationConfig, {
     type: "azureb2c";
 }>;
+export type EntraAuthenticationConfig = Extract<AuthenticationConfig, {
+    type: "entra";
+}>;

package/dist/declarations/config/plugin-versions.d.ts

@@ -0,0 +1,5 @@
+export type PluginVersion = {
+    name: string;
+    version: string;
+};
+export declare const getPluginVersions: (pluginDirs: readonly string[]) => Promise<PluginVersion[]>;

package/dist/declarations/config/validators/ZudokuConfig.d.ts

@@ -248,6 +248,25 @@ declare const AuthenticationSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     disableSignUp: z.ZodOptional<z.ZodBoolean>;
     authorizationParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
     forwardAuthorizationParams: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"entra">;
+    basePath: z.ZodOptional<z.ZodString>;
+    clientId: z.ZodString;
+    tenantId: z.ZodOptional<z.ZodString>;
+    issuer: z.ZodOptional<z.ZodString>;
+    audience: z.ZodOptional<z.ZodString>;
+    scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    redirectToAfterSignUp: z.ZodOptional<z.ZodString>;
+    redirectToAfterSignIn: z.ZodOptional<z.ZodString>;
+    redirectToAfterSignOut: z.ZodOptional<z.ZodString>;
+    signUp: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
+        url: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        authorizationParams: z.ZodRecord<z.ZodString, z.ZodString>;
+    }, z.core.$strict>]>>;
+    disableSignUp: z.ZodOptional<z.ZodBoolean>;
+    authorizationParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    forwardAuthorizationParams: z.ZodOptional<z.ZodArray<z.ZodString>>;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"azureb2c">;
     basePath: z.ZodOptional<z.ZodString>;
@@ -7040,6 +7059,25 @@ export declare const ZudokuConfig: z.ZodObject<{
         disableSignUp: z.ZodOptional<z.ZodBoolean>;
         authorizationParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
         forwardAuthorizationParams: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"entra">;
+        basePath: z.ZodOptional<z.ZodString>;
+        clientId: z.ZodString;
+        tenantId: z.ZodOptional<z.ZodString>;
+        issuer: z.ZodOptional<z.ZodString>;
+        audience: z.ZodOptional<z.ZodString>;
+        scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        redirectToAfterSignUp: z.ZodOptional<z.ZodString>;
+        redirectToAfterSignIn: z.ZodOptional<z.ZodString>;
+        redirectToAfterSignOut: z.ZodOptional<z.ZodString>;
+        signUp: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
+            url: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            authorizationParams: z.ZodRecord<z.ZodString, z.ZodString>;
+        }, z.core.$strict>]>>;
+        disableSignUp: z.ZodOptional<z.ZodBoolean>;
+        authorizationParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        forwardAuthorizationParams: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strip>, z.ZodObject<{
         type: z.ZodLiteral<"azureb2c">;
         basePath: z.ZodOptional<z.ZodString>;

package/dist/declarations/lib/authentication/providers/entra.d.ts

@@ -0,0 +1,13 @@
+import type * as oauth from "oauth4webapi";
+import type { EntraAuthenticationConfig } from "../../../config/config.js";
+import type { AuthenticationPlugin, AuthenticationProviderInitializer } from "../authentication.js";
+import type { UserProfile } from "../state.js";
+import { OpenIDAuthenticationProvider } from "./openid.js";
+export declare class EntraAuthenticationProvider extends OpenIDAuthenticationProvider implements AuthenticationPlugin {
+    constructor(config: EntraAuthenticationConfig);
+    protected getExpectedDiscoveryIssuer(issuerUrl: URL, response: Response): Promise<URL>;
+    protected resolveTokenIssuer(as: oauth.AuthorizationServer, response: Response): Promise<oauth.AuthorizationServer>;
+    protected buildUserProfile(userInfo: oauth.UserInfoResponse, claims: oauth.IDToken | undefined): UserProfile;
+}
+declare const entraAuth: AuthenticationProviderInitializer<EntraAuthenticationConfig>;
+export default entraAuth;

package/dist/declarations/lib/authentication/providers/openid.d.ts

@@ -3,6 +3,7 @@ import type { NavigateFunction } from "react-router";
 import type { OpenIDAuthenticationConfig } from "../../../config/config.js";
 import type { AuthActionContext, AuthActionOptions, AuthenticationPlugin, AuthenticationProviderInitializer, VerifyAccessTokenResult } from "../authentication.js";
 import { CoreAuthenticationPlugin } from "../AuthenticationPlugin.js";
+import { type UserProfile } from "../state.js";
 export interface OpenIdProviderData {
     type: "openid" | undefined;
     accessToken: string;
@@ -48,6 +49,8 @@ export declare class OpenIDAuthenticationProvider extends CoreAuthenticationPlug
         [oauth.allowInsecureRequests]?: undefined;
     };
     protected getAuthServer(): Promise<oauth.AuthorizationServer>;
+    protected getExpectedDiscoveryIssuer(issuerUrl: URL, _response: Response): Promise<URL>;
+    protected resolveTokenIssuer(as: oauth.AuthorizationServer, _response: Response): Promise<oauth.AuthorizationServer>;
     protected setTokensFromResponse(response: oauth.TokenEndpointResponse): void;
     signUp({ navigate }: {
         navigate: NavigateFunction;
@@ -56,7 +59,7 @@ export declare class OpenIDAuthenticationProvider extends CoreAuthenticationPlug
         replace?: boolean;
     }): Promise<void>;
     signIn(_: AuthActionContext, { redirectTo, replace }: AuthActionOptions): Promise<void>;
-    private buildUserProfile;
+    protected buildUserProfile(userInfo: oauth.UserInfoResponse, claims: oauth.IDToken | undefined): UserProfile;
     verifyAccessToken(token: string): Promise<VerifyAccessTokenResult>;
     refreshUserProfile(): Promise<boolean>;
     private authorize;

package/dist/declarations/lib/authentication/providers/util.d.ts

@@ -1,3 +1,7 @@
 import type { NavigateFunction } from "react-router";
 export declare const redirectToSignUpUrl: (url: string, navigate: NavigateFunction, replace?: boolean) => void;
+export declare const getEntraIssuer: (config: {
+    issuer?: string;
+    tenantId?: string;
+}) => string;
 export declare const getClerkFrontendApi: (publishableKey: string) => string;

package/dist/declarations/lib/plugins/openapi/McpClientLogos.d.ts

@@ -0,0 +1,4 @@
+export declare const McpClientLogo: ({ appId, className, }: {
+    appId: string;
+    className?: string;
+}) => import("react").JSX.Element;

package/dist/declarations/lib/plugins/openapi/mcp-configs.d.ts

@@ -26,3 +26,6 @@ export declare const getCursorConfig: (name: string, mcpUrl: string, auth?: Auth
 export declare const getVscodeConfig: (name: string, mcpUrl: string, auth?: AuthHeader) => string;
 export declare const getCodexConfig: (name: string, mcpUrl: string, auth?: AuthHeader) => string;
 export declare const getGenericConfig: (name: string, mcpUrl: string, auth?: AuthHeader) => string;
+export declare const getCursorDeepLink: (name: string, mcpUrl: string, auth?: AuthHeader) => string;
+export declare const getVscodeDeepLink: (name: string, mcpUrl: string, auth?: AuthHeader) => string;
+export declare const CLAUDE_CONNECTORS_URL = "https://claude.ai/customize/connectors?modal=add-custom-connector";

package/dist/declarations/vite/package-root.d.ts

@@ -0,0 +1 @@
+export declare const findPackageRoot: (startDir: string) => Promise<string | undefined>;

package/dist/flat-config.d.ts

@@ -303,6 +303,23 @@ export interface FlatZudokuConfig {
       [k: string]: string
     }
     forwardAuthorizationParams?: string[]
+  } | {
+    type: "entra"
+    basePath?: string
+    clientId: string
+    tenantId?: string
+    issuer?: string
+    audience?: string
+    scopes?: string[]
+    redirectToAfterSignUp?: string
+    redirectToAfterSignIn?: string
+    redirectToAfterSignOut?: string
+    signUp?: _Schema13
+    disableSignUp?: boolean
+    authorizationParams?: {
+      [k: string]: string
+    }
+    forwardAuthorizationParams?: string[]
   } | {
     type: "azureb2c"
     basePath?: string

package/docs/components/landing-page.mdx

@@ -10,7 +10,7 @@ A ready-made, customizable landing page for your developer portal. It comes in t
 covering the most common layouts: a centered hero, a two-column split hero, and a compact
 documentation hub.
 
-Use it as the `element` of a [custom page](/docs/custom-pages) — typically your home page:
+Use it as the `element` of a [custom page](/docs/guides/custom-pages) — typically your home page:
 
 ```tsx title=zudoku.config.tsx
 import { LandingPage } from "zudoku/components";

package/docs/configuration/authentication-azure-ad.md

@@ -72,9 +72,9 @@ to integrate Azure AD with your Zudoku documentation site.
    export default {
      // ... other configuration
      authentication: {
-       type: "openid",
+       type: "entra",
        clientId: "<your-application-client-id>",
-       issuer: "https://login.microsoftonline.com/<your-tenant-id>/v2.0",
+       tenantId: "<your-tenant-id>",
        scopes: ["openid", "profile", "email"], // Optional: customize scopes
      },
      // ... other configuration
@@ -91,20 +91,21 @@ For single tenant (organization-only access):
 
 ```typescript
 authentication: {
-  type: "openid",
+  type: "entra",
   clientId: "<your-application-client-id>",
-  issuer: "https://login.microsoftonline.com/<your-tenant-id>/v2.0",
+  tenantId: "<your-tenant-id>",
   scopes: ["openid", "profile", "email"],
 }
 ```
 
-For multitenant (any Azure AD organization):
+For multitenant (any Azure AD organization), use `tenantId: "common"` or `"organizations"` — this is
+also the default if `tenantId` is omitted:
 
 ```typescript
 authentication: {
-  type: "openid",
+  type: "entra",
   clientId: "<your-application-client-id>",
-  issuer: "https://login.microsoftonline.com/common/v2.0",
+  tenantId: "common",
   scopes: ["openid", "profile", "email"],
 }
 ```
@@ -115,9 +116,9 @@ Request additional Microsoft Graph API scopes:
 
 ```typescript
 authentication: {
-  type: "openid",
+  type: "entra",
   clientId: "<your-application-client-id>",
-  issuer: "https://login.microsoftonline.com/<your-tenant-id>/v2.0",
+  tenantId: "<your-tenant-id>",
   scopes: [
     "openid",
     "profile",
@@ -136,7 +137,7 @@ Protect specific documentation routes using the `protectedRoutes` configuration:
 {
   // ... other configuration
   authentication: {
-    type: "openid",
+    type: "entra",
     // ... Azure AD config
   },
   protectedRoutes: [
@@ -217,16 +218,17 @@ Azure AD provides rich user profile data through OpenID Connect:
 2. **Redirect URI Mismatch**: The redirect URI must exactly match one configured in Azure AD,
    including protocol and path.
 
-3. **Tenant Access Issues**: For single-tenant apps, ensure users are from the correct tenant. For
-   multi-tenant, verify the issuer URL uses "common" or "organizations".
+3. **Tenant Access Issues**: For single-tenant apps, ensure users are from the correct tenant and
+   `tenantId` is set to that tenant's GUID. For multi-tenant, use `tenantId: "common"` or
+   `"organizations"`.
 
 4. **Missing User Information**: Check that required API permissions are granted and admin consent
    is provided if needed.
 
-5. **Token Validation Errors**: Ensure your issuer URL is correct and includes the `/v2.0` endpoint
-   for the Microsoft identity platform.
+5. **Token Validation Errors**: Ensure your `tenantId` is correct. If you use a CIAM tenant
+   (`*.ciamlogin.com`), set the `issuer` option to override the default issuer instead.
 
-6. **Authentication Not Working**: Verify your issuer URL and client ID are correct, and that your
+6. **Authentication Not Working**: Verify your `tenantId` and client ID are correct, and that your
    app registration is configured as a Single-page application (SPA) with the correct redirect URIs.
 
 ## Security Best Practices

package/docs/configuration/authentication.md

@@ -15,8 +15,8 @@ authentication provider you use.
 
 ## Authentication Providers
 
-Zudoku supports Clerk, Auth0, Supabase, Firebase, Azure B2C, and any OpenID Connect provider
-(including Okta, Keycloak, Authentik, and PingFederate).
+Zudoku supports Clerk, Auth0, Supabase, Firebase, Microsoft Entra ID, Azure B2C, and any OpenID
+Connect provider (including Okta, Keycloak, Authentik, and PingFederate).
 
 Not seeing your authentication provider? [Let us know](https://github.com/zuplo/zudoku/issues)
 
@@ -99,6 +99,26 @@ providing your own array of scopes.
 For provider-specific guides (Okta, Keycloak, etc.), see the
 [OpenID Connect setup page](./authentication-openid.md).
 
+### Microsoft Entra ID
+
+For Microsoft Entra ID (formerly Azure AD), you will need the `clientId` from your app registration
+and your `tenantId`.
+
+```typescript
+{
+  // ...
+  authentication: {
+    type: "entra",
+    clientId: "<your-application-client-id>",
+    tenantId: "<your-tenant-id>", // Or "common" for multitenant. Defaults to "common".
+  },
+  // ...
+}
+```
+
+For full setup instructions, see the
+[Azure AD / Entra ID setup guide](./authentication-azure-ad.md).
+
 ### Firebase
 
 For Firebase authentication, you will need your Firebase project configuration. You can find this in

package/docs/guides/mcp-servers.md

@@ -187,3 +187,29 @@ since they use a different interaction model.
 If you are using [Zuplo](https://zuplo.com) to host your API, the `x-mcp-server` extension is
 automatically added to POST operations that use the `mcpServerHandler`. No manual schema changes are
 needed. See the [Zuplo MCP documentation](https://zuplo.com/docs/handlers/mcp-server) for details.
+
+The server name shown in the install snippets (for example `claude mcp add … 'MCP Server' …`) is
+taken from the handler's `name` option — the same name your MCP server advertises to clients. Set it
+to override the default `"MCP Server"` title:
+
+```json title="config/routes.oas.json (paths section)"
+{
+  "/mcp": {
+    "post": {
+      "operationId": "mcpServerHandler",
+      "x-zuplo-route": {
+        "handler": {
+          "export": "mcpServerHandler",
+          "module": "$import(@zuplo/runtime)",
+          "options": {
+            "name": "Acme API",
+            "operations": [{ "file": "./config/routes.oas.json", "id": "get-users" }]
+          }
+        }
+      }
+    }
+  }
+}
+```
+
+With this configuration the snippets read `claude mcp add --transport http 'Acme API' …`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zudoku",
-  "version": "0.82.2",
+  "version": "0.82.4",
   "type": "module",
   "engines": {
     "node": ">=20.19.0 <21.0.0 || >=22.12.0"
@@ -57,6 +57,10 @@
       "types": "./dist/declarations/lib/authentication/providers/openid.d.ts",
       "default": "./src/lib/authentication/providers/openid.tsx"
     },
+    "./auth/entra": {
+      "types": "./dist/declarations/lib/authentication/providers/entra.d.ts",
+      "default": "./src/lib/authentication/providers/entra.tsx"
+    },
     "./auth/supabase": {
       "types": "./dist/declarations/lib/authentication/providers/supabase.d.ts",
       "default": "./src/lib/authentication/providers/supabase.tsx"
@@ -173,12 +177,13 @@
   },
   "dependencies": {
     "@apidevtools/json-schema-ref-parser": "15.3.5",
-    "@base-ui/react": "^1.4.1",
+    "@base-ui/react": "^1.6.0",
     "@envelop/core": "5.5.1",
     "@graphiql/toolkit": "0.12.1",
     "@graphql-typed-document-node/core": "3.2.0",
-    "@hono/node-server": "2.0.3",
+    "@hono/node-server": "2.0.8",
     "@lekoarts/rehype-meta-as-attributes": "3.0.3",
+    "@mdx-js/mdx": "3.1.1",
     "@mdx-js/react": "3.1.1",
     "@mdx-js/rollup": "3.1.1",
     "@pothos/core": "4.12.0",
@@ -206,21 +211,20 @@
     "@radix-ui/react-toggle-group": "1.1.11",
     "@radix-ui/react-tooltip": "1.2.8",
     "@radix-ui/react-visually-hidden": "1.2.4",
-    "@scalar/openapi-parser": "0.23.13",
+    "@scalar/openapi-parser": "0.28.4",
     "@scalar/snippetz": "0.9.11",
-    "@sentry/node": "10.52.0",
     "@shikijs/langs": "4.2.0",
     "@shikijs/rehype": "4.2.0",
     "@shikijs/themes": "4.2.0",
     "@shikijs/transformers": "4.2.0",
-    "@tailwindcss/typography": "0.5.19",
+    "@tailwindcss/typography": "0.5.20",
     "@tailwindcss/vite": "4.3.0",
     "@tanem/react-nprogress": "6.0.3",
     "@tanstack/react-query": "5.101.0",
     "@types/react": "19.2.17",
     "@types/react-dom": "19.2.3",
-    "@vitejs/plugin-react": "6.0.2",
-    "@x0k/json-schema-merge": "1.0.3",
+    "@vitejs/plugin-react": "6.0.3",
+    "@x0k/json-schema-merge": "1.0.4",
     "@unhead/react": "3.1.3",
     "@zuplo/mcp": "0.0.32",
     "bs58": "6.0.0",
@@ -242,14 +246,14 @@
     "hast-util-heading-rank": "3.0.0",
     "hast-util-to-jsx-runtime": "2.3.6",
     "hast-util-to-string": "3.0.1",
-    "hono": "4.12.25",
+    "hono": "4.12.27",
     "http-terminator": "3.2.0",
     "javascript-stringify": "2.1.0",
     "jose": "6.2.3",
     "json-schema-to-typescript-lite": "15.0.0",
     "loglevel": "1.9.2",
     "lucide-react": "1.16.0",
-    "mdast-util-from-markdown": "2.0.2",
+    "mdast-util-from-markdown": "2.0.3",
     "mdast-util-mdx": "3.0.0",
     "mdast-util-mdx-jsx": "3.2.0",
     "micromark-extension-mdxjs": "3.0.0",
@@ -261,7 +265,7 @@
     "pagefind": "1.5.2",
     "picocolors": "1.1.1",
     "piscina": "5.2.0",
-    "posthog-node": "5.36.2",
+    "posthog-node": "5.40.0",
     "quick-lru": "7.3.0",
     "react-error-boundary": "6.1.1",
     "react-hook-form": "7.76.1",
@@ -277,7 +281,7 @@
     "remark-frontmatter": "5.0.0",
     "remark-gfm": "4.0.1",
     "remark-mdx-frontmatter": "5.2.0",
-    "semver": "7.8.2",
+    "semver": "7.8.5",
     "shiki": "4.2.0",
     "sitemap": "9.0.1",
     "strip-ansi": "7.2.0",
@@ -295,7 +299,7 @@
     "zustand": "5.0.14"
   },
   "devDependencies": {
-    "@graphql-codegen/cli": "7.1.1",
+    "@graphql-codegen/cli": "7.1.3",
     "@inkeep/cxkit-types": "0.5.119",
     "@testing-library/dom": "10.4.1",
     "@testing-library/jest-dom": "6.9.1",
@@ -307,15 +311,15 @@
     "@types/hast": "3.0.4",
     "@types/json-schema": "7.0.15",
     "@types/mdast": "4.0.4",
-    "@types/mdx": "2.0.13",
+    "@types/mdx": "2.0.14",
     "@types/node": "22.19.1",
     "@types/react-is": "19.2.0",
     "@types/semver": "7.7.1",
     "@types/unist": "3.0.3",
     "@types/yargs": "17.0.35",
-    "@typescript/native-preview": "7.0.0-dev.20260610.1",
-    "@vitest/coverage-v8": "4.1.8",
-    "happy-dom": "20.10.2",
+    "@typescript/native-preview": "7.0.0-dev.20260624.1",
+    "@vitest/coverage-v8": "4.1.9",
+    "happy-dom": "20.10.6",
     "oxc-parser": "^0.135.0",
     "react": "19.2.7",
     "react-dom": "19.2.7",

package/src/app/entry.server.tsx

@@ -26,7 +26,7 @@ import type { Adapter } from "./adapter.js";
 import { getRoutesByConfig } from "./main.js";
 import { protectChunks as rawProtectChunks } from "./protectChunks.js";
 import { getSsrCacheControl } from "./ssrCacheControl.js";
-import { wrapProtectedRoutes } from "./wrapProtectedRoutes.js";
+import { wrapProtectedRoutesForRender } from "./wrapProtectedRoutes.js";
 
 export { getRoutesByConfig };
 export type { Adapter, AdapterContext } from "./adapter.js";
@@ -104,12 +104,16 @@ export const handleRequest = async ({
   const ssrAuth = await resolveSsrAuth(request);
 
   // No-op lazy() on protected subtrees for unauthed requests so loaders
-  // don't run for a 401 render.
-  const effectiveRoutes = wrapProtectedRoutes(
+  // don't run for a 401 render. A bypass render (search-index pass) keeps the
+  // real content so Pagefind can index protected routes.
+  const effectiveRoutes = wrapProtectedRoutesForRender(
     routes,
     config.protectedRoutes,
-    !!ssrAuth?.profile,
-    basePath,
+    {
+      isAuthenticated: !!ssrAuth?.profile,
+      bypassProtection,
+      basePath,
+    },
   );
 
   const { query, dataRoutes } = createStaticHandler(effectiveRoutes, {

package/src/app/wrapProtectedRoutes.ts

@@ -47,6 +47,31 @@ export const wrapProtectedRoutes = (
   });
 };
 
+// Route-wrapping decision for an SSR/SSG render. The prerender does a second
+// "bypass" pass over protected routes to build the search index; that pass must
+// render the real (unstubbed) protected content, so it is treated as
+// authenticated here. Without this, the bypass pass renders an empty shell and
+// the Pagefind index for protected routes ends up empty (issue #2672).
+export const wrapProtectedRoutesForRender = (
+  routes: RouteObject[],
+  protectedRoutes: ProtectedRoutesInput,
+  {
+    isAuthenticated,
+    bypassProtection,
+    basePath,
+  }: {
+    isAuthenticated: boolean;
+    bypassProtection?: boolean;
+    basePath?: string;
+  },
+): RouteObject[] =>
+  wrapProtectedRoutes(
+    routes,
+    protectedRoutes,
+    isAuthenticated || bypassProtection === true,
+    basePath,
+  );
+
 // Inline elements can't be chunk-isolated; RouteGuard still blocks render,
 // but the JS ships in the main bundle. Only meaningful in dev.
 export const warnInlineProtectedRoutes = (

package/src/config/config.ts

@@ -33,3 +33,7 @@ export type AzureB2CAuthenticationConfig = Extract<
   AuthenticationConfig,
   { type: "azureb2c" }
 >;
+export type EntraAuthenticationConfig = Extract<
+  AuthenticationConfig,
+  { type: "entra" }
+>;

package/src/config/loader.ts

@@ -12,6 +12,7 @@ import { getZudokuRootDir } from "../cli/common/package-json.js";
 import { runPluginTransformConfig } from "../lib/core/transform-config.js";
 import invariant from "../lib/util/invariant.js";
 import { fileExists } from "./file-exists.js";
+import { getPluginVersions } from "./plugin-versions.js";
 import type {
   ResolvedZudokuConfig,
   ZudokuConfig,
@@ -240,6 +241,20 @@ export async function loadZudokuConfig(
       { timestamp: true },
     );
 
+    // Surface which versions of external plugins (created via `createPlugin`)
+    // the build is running, so build logs can pin down e.g. the monetization
+    // plugin version without each plugin having to log it itself.
+    const pluginVersions = await getPluginVersions(config.__pluginDirs ?? []);
+    if (pluginVersions.length > 0) {
+      logger.info(
+        colors.cyan(`loaded plugins `) +
+          colors.dim(
+            pluginVersions.map((p) => `${p.name}@${p.version}`).join(", "),
+          ),
+        { timestamp: true },
+      );
+    }
+
     return { config, envPrefix, publicEnv };
   } catch (error) {
     const lastValid = getConfig();

package/src/config/plugin-versions.ts

@@ -0,0 +1,38 @@
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+import { findPackageRoot } from "../vite/package-root.js";
+
+export type PluginVersion = { name: string; version: string };
+
+// Reads the `name`@`version` from each plugin dir's nearest package.json,
+// deduped by package name.
+export const getPluginVersions = async (
+  pluginDirs: readonly string[],
+): Promise<PluginVersion[]> => {
+  const roots = await Promise.all(
+    [...new Set(pluginDirs)].map(findPackageRoot),
+  );
+
+  const resolved = await Promise.all(
+    roots.map(async (root): Promise<PluginVersion | undefined> => {
+      if (!root) return undefined;
+      try {
+        const pkg = JSON.parse(
+          await readFile(path.join(root, "package.json"), "utf-8"),
+        ) as { name?: string; version?: string };
+        if (!pkg.name) return undefined;
+        return { name: pkg.name, version: pkg.version ?? "unknown" };
+      } catch {
+        // A plugin without a readable package.json simply isn't reported.
+        return undefined;
+      }
+    }),
+  );
+
+  const byName = new Map<string, PluginVersion>();
+  for (const version of resolved) {
+    if (version && !byName.has(version.name)) byName.set(version.name, version);
+  }
+
+  return [...byName.values()];
+};