zudoku 0.82.3 → 0.82.4

package/dist/cli/cli.js

@@ -134,7 +134,6 @@ var init_llms = __esm({
 });
 
 // src/cli/cli.ts
-import * as Sentry2 from "@sentry/node";
 import { hideBin } from "yargs/helpers";
 import yargs from "yargs/yargs";
 
@@ -3384,6 +3383,25 @@ var AuthenticationSchema = z7.discriminatedUnion("type", [
     authorizationParams: z7.record(z7.string(), z7.string()).optional(),
     forwardAuthorizationParams: z7.array(z7.string()).optional()
   }),
+  z7.object({
+    type: z7.literal("entra"),
+    basePath: z7.string().optional(),
+    clientId: z7.string(),
+    // Tenant id or one of Entra's multi-tenant authorities
+    // (common/organizations/consumers). Defaults to "common".
+    tenantId: z7.string().optional(),
+    // Full issuer override, e.g. for CIAM tenants on *.ciamlogin.com.
+    issuer: z7.string().optional(),
+    audience: z7.string().optional(),
+    scopes: z7.array(z7.string()).optional(),
+    redirectToAfterSignUp: z7.string().optional(),
+    redirectToAfterSignIn: z7.string().optional(),
+    redirectToAfterSignOut: z7.string().optional(),
+    signUp: SignUpOpenIdSchema.optional(),
+    disableSignUp: z7.boolean().optional(),
+    authorizationParams: z7.record(z7.string(), z7.string()).optional(),
+    forwardAuthorizationParams: z7.array(z7.string()).optional()
+  }),
   z7.object({
     type: z7.literal("azureb2c"),
     basePath: z7.string().optional(),
@@ -3840,6 +3858,7 @@ async function loadZudokuConfig(configEnv, rootDir) {
 }
 
 // src/lib/authentication/providers/util.ts
+var getEntraIssuer = (config) => config.issuer ?? `https://login.microsoftonline.com/${config.tenantId ?? "common"}/v2.0`;
 var getClerkFrontendApi = (publishableKey) => {
   const parts = publishableKey.split("_");
   if (parts.length !== 3 || !parts[2]) {
@@ -3873,6 +3892,9 @@ var getIssuer = async (config) => {
     case "openid": {
       return config.authentication.issuer;
     }
+    case "entra": {
+      return getEntraIssuer(config.authentication);
+    }
     case "supabase": {
       return config.authentication.supabaseUrl;
     }
@@ -8506,17 +8528,7 @@ var bundleSSREntry = async (options) => {
 };
 
 // src/cli/common/output.ts
-import * as Sentry from "@sentry/node";
 import colors8 from "picocolors";
-
-// src/cli/common/constants.ts
-var CLI_XDG_FOLDER_NAME = "zudoku";
-var VERSION_CHECK_FILE = "version.json";
-var SENTRY_DSN = void 0;
-var MAX_WAIT_PENDING_TIME_MS = 1e3;
-var POST_HOG_CAPTURE_KEY = void 0;
-
-// src/cli/common/output.ts
 function printDiagnosticsToConsole(message) {
   console.error(colors8.bold(colors8.blue(message)));
 }
@@ -8590,6 +8602,11 @@ async function build(argv) {
 // src/cli/common/analytics/lib.ts
 import { PostHog } from "posthog-node";
 
+// src/cli/common/constants.ts
+var CLI_XDG_FOLDER_NAME = "zudoku";
+var VERSION_CHECK_FILE = "version.json";
+var POST_HOG_CAPTURE_KEY = void 0;
+
 // src/cli/common/machine-id/lib.ts
 import { execSync } from "node:child_process";
 import { createHash } from "node:crypto";
@@ -9402,12 +9419,6 @@ To fix, run:
 // src/cli/cli.ts
 process.env.ZUDOKU_ENV = process.env.ZUDOKU_INTERNAL_DEV ? "internal" : "module";
 var packageJson = getZudokuPackageJson();
-if (SENTRY_DSN) {
-  Sentry2.init({
-    dsn: SENTRY_DSN,
-    release: packageJson?.version
-  });
-}
 var cli = yargs(hideBin(process.argv)).option("zuplo", {
   type: "boolean",
   description: "Enable Zuplo mode",
@@ -9421,14 +9432,7 @@ var cli = yargs(hideBin(process.argv)).option("zuplo", {
 try {
   void warnIfOutdatedVersion(packageJson?.version);
   await cli.argv;
-  void Sentry2.close(MAX_WAIT_PENDING_TIME_MS).then(() => {
-    process.exit(0);
-  });
-} catch (err) {
-  if (err instanceof Error) {
-    Sentry2.captureException(err);
-  }
-  throw err;
 } finally {
   await shutdownAnalytics();
 }
+process.exit();

package/dist/cli/worker.js

@@ -2617,6 +2617,25 @@ var AuthenticationSchema = z4.discriminatedUnion("type", [
     authorizationParams: z4.record(z4.string(), z4.string()).optional(),
     forwardAuthorizationParams: z4.array(z4.string()).optional()
   }),
+  z4.object({
+    type: z4.literal("entra"),
+    basePath: z4.string().optional(),
+    clientId: z4.string(),
+    // Tenant id or one of Entra's multi-tenant authorities
+    // (common/organizations/consumers). Defaults to "common".
+    tenantId: z4.string().optional(),
+    // Full issuer override, e.g. for CIAM tenants on *.ciamlogin.com.
+    issuer: z4.string().optional(),
+    audience: z4.string().optional(),
+    scopes: z4.array(z4.string()).optional(),
+    redirectToAfterSignUp: z4.string().optional(),
+    redirectToAfterSignIn: z4.string().optional(),
+    redirectToAfterSignOut: z4.string().optional(),
+    signUp: SignUpOpenIdSchema.optional(),
+    disableSignUp: z4.boolean().optional(),
+    authorizationParams: z4.record(z4.string(), z4.string()).optional(),
+    forwardAuthorizationParams: z4.array(z4.string()).optional()
+  }),
   z4.object({
     type: z4.literal("azureb2c"),
     basePath: z4.string().optional(),

package/dist/declarations/config/config.d.ts

@@ -22,3 +22,6 @@ export type FirebaseAuthenticationConfig = Extract<AuthenticationConfig, {
 export type AzureB2CAuthenticationConfig = Extract<AuthenticationConfig, {
     type: "azureb2c";
 }>;
+export type EntraAuthenticationConfig = Extract<AuthenticationConfig, {
+    type: "entra";
+}>;

package/dist/declarations/config/validators/ZudokuConfig.d.ts

@@ -248,6 +248,25 @@ declare const AuthenticationSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     disableSignUp: z.ZodOptional<z.ZodBoolean>;
     authorizationParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
     forwardAuthorizationParams: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"entra">;
+    basePath: z.ZodOptional<z.ZodString>;
+    clientId: z.ZodString;
+    tenantId: z.ZodOptional<z.ZodString>;
+    issuer: z.ZodOptional<z.ZodString>;
+    audience: z.ZodOptional<z.ZodString>;
+    scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    redirectToAfterSignUp: z.ZodOptional<z.ZodString>;
+    redirectToAfterSignIn: z.ZodOptional<z.ZodString>;
+    redirectToAfterSignOut: z.ZodOptional<z.ZodString>;
+    signUp: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
+        url: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        authorizationParams: z.ZodRecord<z.ZodString, z.ZodString>;
+    }, z.core.$strict>]>>;
+    disableSignUp: z.ZodOptional<z.ZodBoolean>;
+    authorizationParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    forwardAuthorizationParams: z.ZodOptional<z.ZodArray<z.ZodString>>;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"azureb2c">;
     basePath: z.ZodOptional<z.ZodString>;
@@ -7040,6 +7059,25 @@ export declare const ZudokuConfig: z.ZodObject<{
         disableSignUp: z.ZodOptional<z.ZodBoolean>;
         authorizationParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
         forwardAuthorizationParams: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"entra">;
+        basePath: z.ZodOptional<z.ZodString>;
+        clientId: z.ZodString;
+        tenantId: z.ZodOptional<z.ZodString>;
+        issuer: z.ZodOptional<z.ZodString>;
+        audience: z.ZodOptional<z.ZodString>;
+        scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        redirectToAfterSignUp: z.ZodOptional<z.ZodString>;
+        redirectToAfterSignIn: z.ZodOptional<z.ZodString>;
+        redirectToAfterSignOut: z.ZodOptional<z.ZodString>;
+        signUp: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
+            url: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            authorizationParams: z.ZodRecord<z.ZodString, z.ZodString>;
+        }, z.core.$strict>]>>;
+        disableSignUp: z.ZodOptional<z.ZodBoolean>;
+        authorizationParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        forwardAuthorizationParams: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strip>, z.ZodObject<{
         type: z.ZodLiteral<"azureb2c">;
         basePath: z.ZodOptional<z.ZodString>;

package/dist/declarations/lib/authentication/providers/entra.d.ts

@@ -0,0 +1,13 @@
+import type * as oauth from "oauth4webapi";
+import type { EntraAuthenticationConfig } from "../../../config/config.js";
+import type { AuthenticationPlugin, AuthenticationProviderInitializer } from "../authentication.js";
+import type { UserProfile } from "../state.js";
+import { OpenIDAuthenticationProvider } from "./openid.js";
+export declare class EntraAuthenticationProvider extends OpenIDAuthenticationProvider implements AuthenticationPlugin {
+    constructor(config: EntraAuthenticationConfig);
+    protected getExpectedDiscoveryIssuer(issuerUrl: URL, response: Response): Promise<URL>;
+    protected resolveTokenIssuer(as: oauth.AuthorizationServer, response: Response): Promise<oauth.AuthorizationServer>;
+    protected buildUserProfile(userInfo: oauth.UserInfoResponse, claims: oauth.IDToken | undefined): UserProfile;
+}
+declare const entraAuth: AuthenticationProviderInitializer<EntraAuthenticationConfig>;
+export default entraAuth;

package/dist/declarations/lib/authentication/providers/openid.d.ts

@@ -3,6 +3,7 @@ import type { NavigateFunction } from "react-router";
 import type { OpenIDAuthenticationConfig } from "../../../config/config.js";
 import type { AuthActionContext, AuthActionOptions, AuthenticationPlugin, AuthenticationProviderInitializer, VerifyAccessTokenResult } from "../authentication.js";
 import { CoreAuthenticationPlugin } from "../AuthenticationPlugin.js";
+import { type UserProfile } from "../state.js";
 export interface OpenIdProviderData {
     type: "openid" | undefined;
     accessToken: string;
@@ -48,6 +49,8 @@ export declare class OpenIDAuthenticationProvider extends CoreAuthenticationPlug
         [oauth.allowInsecureRequests]?: undefined;
     };
     protected getAuthServer(): Promise<oauth.AuthorizationServer>;
+    protected getExpectedDiscoveryIssuer(issuerUrl: URL, _response: Response): Promise<URL>;
+    protected resolveTokenIssuer(as: oauth.AuthorizationServer, _response: Response): Promise<oauth.AuthorizationServer>;
     protected setTokensFromResponse(response: oauth.TokenEndpointResponse): void;
     signUp({ navigate }: {
         navigate: NavigateFunction;
@@ -56,7 +59,7 @@ export declare class OpenIDAuthenticationProvider extends CoreAuthenticationPlug
         replace?: boolean;
     }): Promise<void>;
     signIn(_: AuthActionContext, { redirectTo, replace }: AuthActionOptions): Promise<void>;
-    private buildUserProfile;
+    protected buildUserProfile(userInfo: oauth.UserInfoResponse, claims: oauth.IDToken | undefined): UserProfile;
     verifyAccessToken(token: string): Promise<VerifyAccessTokenResult>;
     refreshUserProfile(): Promise<boolean>;
     private authorize;

package/dist/declarations/lib/authentication/providers/util.d.ts

@@ -1,3 +1,7 @@
 import type { NavigateFunction } from "react-router";
 export declare const redirectToSignUpUrl: (url: string, navigate: NavigateFunction, replace?: boolean) => void;
+export declare const getEntraIssuer: (config: {
+    issuer?: string;
+    tenantId?: string;
+}) => string;
 export declare const getClerkFrontendApi: (publishableKey: string) => string;

package/dist/declarations/lib/plugins/openapi/McpClientLogos.d.ts

@@ -0,0 +1,4 @@
+export declare const McpClientLogo: ({ appId, className, }: {
+    appId: string;
+    className?: string;
+}) => import("react").JSX.Element;

package/dist/declarations/lib/plugins/openapi/mcp-configs.d.ts

@@ -26,3 +26,6 @@ export declare const getCursorConfig: (name: string, mcpUrl: string, auth?: Auth
 export declare const getVscodeConfig: (name: string, mcpUrl: string, auth?: AuthHeader) => string;
 export declare const getCodexConfig: (name: string, mcpUrl: string, auth?: AuthHeader) => string;
 export declare const getGenericConfig: (name: string, mcpUrl: string, auth?: AuthHeader) => string;
+export declare const getCursorDeepLink: (name: string, mcpUrl: string, auth?: AuthHeader) => string;
+export declare const getVscodeDeepLink: (name: string, mcpUrl: string, auth?: AuthHeader) => string;
+export declare const CLAUDE_CONNECTORS_URL = "https://claude.ai/customize/connectors?modal=add-custom-connector";

package/dist/flat-config.d.ts

@@ -303,6 +303,23 @@ export interface FlatZudokuConfig {
       [k: string]: string
     }
     forwardAuthorizationParams?: string[]
+  } | {
+    type: "entra"
+    basePath?: string
+    clientId: string
+    tenantId?: string
+    issuer?: string
+    audience?: string
+    scopes?: string[]
+    redirectToAfterSignUp?: string
+    redirectToAfterSignIn?: string
+    redirectToAfterSignOut?: string
+    signUp?: _Schema13
+    disableSignUp?: boolean
+    authorizationParams?: {
+      [k: string]: string
+    }
+    forwardAuthorizationParams?: string[]
   } | {
     type: "azureb2c"
     basePath?: string

package/docs/configuration/authentication-azure-ad.md

@@ -72,9 +72,9 @@ to integrate Azure AD with your Zudoku documentation site.
    export default {
      // ... other configuration
      authentication: {
-       type: "openid",
+       type: "entra",
        clientId: "<your-application-client-id>",
-       issuer: "https://login.microsoftonline.com/<your-tenant-id>/v2.0",
+       tenantId: "<your-tenant-id>",
        scopes: ["openid", "profile", "email"], // Optional: customize scopes
      },
      // ... other configuration
@@ -91,20 +91,21 @@ For single tenant (organization-only access):
 
 ```typescript
 authentication: {
-  type: "openid",
+  type: "entra",
   clientId: "<your-application-client-id>",
-  issuer: "https://login.microsoftonline.com/<your-tenant-id>/v2.0",
+  tenantId: "<your-tenant-id>",
   scopes: ["openid", "profile", "email"],
 }
 ```
 
-For multitenant (any Azure AD organization):
+For multitenant (any Azure AD organization), use `tenantId: "common"` or `"organizations"` — this is
+also the default if `tenantId` is omitted:
 
 ```typescript
 authentication: {
-  type: "openid",
+  type: "entra",
   clientId: "<your-application-client-id>",
-  issuer: "https://login.microsoftonline.com/common/v2.0",
+  tenantId: "common",
   scopes: ["openid", "profile", "email"],
 }
 ```
@@ -115,9 +116,9 @@ Request additional Microsoft Graph API scopes:
 
 ```typescript
 authentication: {
-  type: "openid",
+  type: "entra",
   clientId: "<your-application-client-id>",
-  issuer: "https://login.microsoftonline.com/<your-tenant-id>/v2.0",
+  tenantId: "<your-tenant-id>",
   scopes: [
     "openid",
     "profile",
@@ -136,7 +137,7 @@ Protect specific documentation routes using the `protectedRoutes` configuration:
 {
   // ... other configuration
   authentication: {
-    type: "openid",
+    type: "entra",
     // ... Azure AD config
   },
   protectedRoutes: [
@@ -217,16 +218,17 @@ Azure AD provides rich user profile data through OpenID Connect:
 2. **Redirect URI Mismatch**: The redirect URI must exactly match one configured in Azure AD,
    including protocol and path.
 
-3. **Tenant Access Issues**: For single-tenant apps, ensure users are from the correct tenant. For
-   multi-tenant, verify the issuer URL uses "common" or "organizations".
+3. **Tenant Access Issues**: For single-tenant apps, ensure users are from the correct tenant and
+   `tenantId` is set to that tenant's GUID. For multi-tenant, use `tenantId: "common"` or
+   `"organizations"`.
 
 4. **Missing User Information**: Check that required API permissions are granted and admin consent
    is provided if needed.
 
-5. **Token Validation Errors**: Ensure your issuer URL is correct and includes the `/v2.0` endpoint
-   for the Microsoft identity platform.
+5. **Token Validation Errors**: Ensure your `tenantId` is correct. If you use a CIAM tenant
+   (`*.ciamlogin.com`), set the `issuer` option to override the default issuer instead.
 
-6. **Authentication Not Working**: Verify your issuer URL and client ID are correct, and that your
+6. **Authentication Not Working**: Verify your `tenantId` and client ID are correct, and that your
    app registration is configured as a Single-page application (SPA) with the correct redirect URIs.
 
 ## Security Best Practices

package/docs/configuration/authentication.md

@@ -15,8 +15,8 @@ authentication provider you use.
 
 ## Authentication Providers
 
-Zudoku supports Clerk, Auth0, Supabase, Firebase, Azure B2C, and any OpenID Connect provider
-(including Okta, Keycloak, Authentik, and PingFederate).
+Zudoku supports Clerk, Auth0, Supabase, Firebase, Microsoft Entra ID, Azure B2C, and any OpenID
+Connect provider (including Okta, Keycloak, Authentik, and PingFederate).
 
 Not seeing your authentication provider? [Let us know](https://github.com/zuplo/zudoku/issues)
 
@@ -99,6 +99,26 @@ providing your own array of scopes.
 For provider-specific guides (Okta, Keycloak, etc.), see the
 [OpenID Connect setup page](./authentication-openid.md).
 
+### Microsoft Entra ID
+
+For Microsoft Entra ID (formerly Azure AD), you will need the `clientId` from your app registration
+and your `tenantId`.
+
+```typescript
+{
+  // ...
+  authentication: {
+    type: "entra",
+    clientId: "<your-application-client-id>",
+    tenantId: "<your-tenant-id>", // Or "common" for multitenant. Defaults to "common".
+  },
+  // ...
+}
+```
+
+For full setup instructions, see the
+[Azure AD / Entra ID setup guide](./authentication-azure-ad.md).
+
 ### Firebase
 
 For Firebase authentication, you will need your Firebase project configuration. You can find this in

package/docs/guides/mcp-servers.md

@@ -187,3 +187,29 @@ since they use a different interaction model.
 If you are using [Zuplo](https://zuplo.com) to host your API, the `x-mcp-server` extension is
 automatically added to POST operations that use the `mcpServerHandler`. No manual schema changes are
 needed. See the [Zuplo MCP documentation](https://zuplo.com/docs/handlers/mcp-server) for details.
+
+The server name shown in the install snippets (for example `claude mcp add … 'MCP Server' …`) is
+taken from the handler's `name` option — the same name your MCP server advertises to clients. Set it
+to override the default `"MCP Server"` title:
+
+```json title="config/routes.oas.json (paths section)"
+{
+  "/mcp": {
+    "post": {
+      "operationId": "mcpServerHandler",
+      "x-zuplo-route": {
+        "handler": {
+          "export": "mcpServerHandler",
+          "module": "$import(@zuplo/runtime)",
+          "options": {
+            "name": "Acme API",
+            "operations": [{ "file": "./config/routes.oas.json", "id": "get-users" }]
+          }
+        }
+      }
+    }
+  }
+}
+```
+
+With this configuration the snippets read `claude mcp add --transport http 'Acme API' …`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zudoku",
-  "version": "0.82.3",
+  "version": "0.82.4",
   "type": "module",
   "engines": {
     "node": ">=20.19.0 <21.0.0 || >=22.12.0"
@@ -57,6 +57,10 @@
       "types": "./dist/declarations/lib/authentication/providers/openid.d.ts",
       "default": "./src/lib/authentication/providers/openid.tsx"
     },
+    "./auth/entra": {
+      "types": "./dist/declarations/lib/authentication/providers/entra.d.ts",
+      "default": "./src/lib/authentication/providers/entra.tsx"
+    },
     "./auth/supabase": {
       "types": "./dist/declarations/lib/authentication/providers/supabase.d.ts",
       "default": "./src/lib/authentication/providers/supabase.tsx"
@@ -173,13 +177,13 @@
   },
   "dependencies": {
     "@apidevtools/json-schema-ref-parser": "15.3.5",
-    "@base-ui/react": "^1.4.1",
+    "@base-ui/react": "^1.6.0",
     "@envelop/core": "5.5.1",
     "@graphiql/toolkit": "0.12.1",
     "@graphql-typed-document-node/core": "3.2.0",
     "@hono/node-server": "2.0.8",
     "@lekoarts/rehype-meta-as-attributes": "3.0.3",
-    "@mdx-js/mdx": "3.1.0",
+    "@mdx-js/mdx": "3.1.1",
     "@mdx-js/react": "3.1.1",
     "@mdx-js/rollup": "3.1.1",
     "@pothos/core": "4.12.0",
@@ -209,7 +213,6 @@
     "@radix-ui/react-visually-hidden": "1.2.4",
     "@scalar/openapi-parser": "0.28.4",
     "@scalar/snippetz": "0.9.11",
-    "@sentry/node": "10.62.0",
     "@shikijs/langs": "4.2.0",
     "@shikijs/rehype": "4.2.0",
     "@shikijs/themes": "4.2.0",
@@ -220,8 +223,8 @@
     "@tanstack/react-query": "5.101.0",
     "@types/react": "19.2.17",
     "@types/react-dom": "19.2.3",
-    "@vitejs/plugin-react": "6.0.2",
-    "@x0k/json-schema-merge": "1.0.3",
+    "@vitejs/plugin-react": "6.0.3",
+    "@x0k/json-schema-merge": "1.0.4",
     "@unhead/react": "3.1.3",
     "@zuplo/mcp": "0.0.32",
     "bs58": "6.0.0",
@@ -250,7 +253,7 @@
     "json-schema-to-typescript-lite": "15.0.0",
     "loglevel": "1.9.2",
     "lucide-react": "1.16.0",
-    "mdast-util-from-markdown": "2.0.2",
+    "mdast-util-from-markdown": "2.0.3",
     "mdast-util-mdx": "3.0.0",
     "mdast-util-mdx-jsx": "3.2.0",
     "micromark-extension-mdxjs": "3.0.0",
@@ -262,7 +265,7 @@
     "pagefind": "1.5.2",
     "picocolors": "1.1.1",
     "piscina": "5.2.0",
-    "posthog-node": "5.36.2",
+    "posthog-node": "5.40.0",
     "quick-lru": "7.3.0",
     "react-error-boundary": "6.1.1",
     "react-hook-form": "7.76.1",
@@ -316,7 +319,7 @@
     "@types/yargs": "17.0.35",
     "@typescript/native-preview": "7.0.0-dev.20260624.1",
     "@vitest/coverage-v8": "4.1.9",
-    "happy-dom": "20.10.2",
+    "happy-dom": "20.10.6",
     "oxc-parser": "^0.135.0",
     "react": "19.2.7",
     "react-dom": "19.2.7",

package/src/config/config.ts

@@ -33,3 +33,7 @@ export type AzureB2CAuthenticationConfig = Extract<
   AuthenticationConfig,
   { type: "azureb2c" }
 >;
+export type EntraAuthenticationConfig = Extract<
+  AuthenticationConfig,
+  { type: "entra" }
+>;

package/src/config/validators/ZudokuConfig.ts

@@ -486,6 +486,25 @@ const AuthenticationSchema = z.discriminatedUnion("type", [
     authorizationParams: z.record(z.string(), z.string()).optional(),
     forwardAuthorizationParams: z.array(z.string()).optional(),
   }),
+  z.object({
+    type: z.literal("entra"),
+    basePath: z.string().optional(),
+    clientId: z.string(),
+    // Tenant id or one of Entra's multi-tenant authorities
+    // (common/organizations/consumers). Defaults to "common".
+    tenantId: z.string().optional(),
+    // Full issuer override, e.g. for CIAM tenants on *.ciamlogin.com.
+    issuer: z.string().optional(),
+    audience: z.string().optional(),
+    scopes: z.array(z.string()).optional(),
+    redirectToAfterSignUp: z.string().optional(),
+    redirectToAfterSignIn: z.string().optional(),
+    redirectToAfterSignOut: z.string().optional(),
+    signUp: SignUpOpenIdSchema.optional(),
+    disableSignUp: z.boolean().optional(),
+    authorizationParams: z.record(z.string(), z.string()).optional(),
+    forwardAuthorizationParams: z.array(z.string()).optional(),
+  }),
   z.object({
     type: z.literal("azureb2c"),
     basePath: z.string().optional(),

package/src/lib/auth/issuer.ts

@@ -1,5 +1,8 @@
 import type { ZudokuConfig } from "../../config/validators/ZudokuConfig.js";
-import { getClerkFrontendApi } from "../authentication/providers/util.js";
+import {
+  getClerkFrontendApi,
+  getEntraIssuer,
+} from "../authentication/providers/util.js";
 
 export const getIssuer = async (config: ZudokuConfig) => {
   switch (config.authentication?.type) {
@@ -12,6 +15,9 @@ export const getIssuer = async (config: ZudokuConfig) => {
     case "openid": {
       return config.authentication.issuer;
     }
+    case "entra": {
+      return getEntraIssuer(config.authentication);
+    }
     case "supabase": {
       return config.authentication.supabaseUrl;
     }