zudoku 0.91.0 → 0.93.0

package/dist/cli/cli.js

@@ -3402,6 +3402,7 @@ var ApiOptionsSchema = z7.object({
   supportedLanguages: z7.array(LanguageOption),
   disablePlayground: z7.boolean(),
   disableSidecar: z7.boolean(),
+  disableRequestBox: z7.boolean(),
   showVersionSelect: z7.enum(["always", "if-available", "hide"]),
   expandAllTags: z7.boolean(),
   showInfoPage: z7.boolean(),
@@ -6816,6 +6817,7 @@ var generateDefaultApiOptionsCode = () => [
   `  supportedLanguages: config.defaults?.apis?.supportedLanguages,`,
   `  disablePlayground: config.defaults?.apis?.disablePlayground,`,
   `  disableSidecar: config.defaults?.apis?.disableSidecar,`,
+  `  disableRequestBox: config.defaults?.apis?.disableRequestBox,`,
   `  disableSecurity: config.defaults?.apis?.disableSecurity ?? true,`,
   `  disableMcpAuthInstructions: config.defaults?.apis?.disableMcpAuthInstructions,`,
   `  showVersionSelect: config.defaults?.apis?.showVersionSelect ?? "if-available",`,
@@ -9105,6 +9107,98 @@ import { cp, mkdir as mkdir3, readdir, rm, writeFile as writeFile4 } from "node:
 import path20 from "node:path";
 init_joinUrl();
 
+// src/lib/util/redirectPattern.ts
+init_joinUrl();
+var SPLAT = "*";
+var ABSOLUTE_URL_REGEX = /^(?:[a-z][a-z0-9+.-]*:|[\\/]{2})/i;
+var TOKEN_REGEX = /\/(?::([\w-]+)|\*)(?=[/?#]|$)/g;
+var parseSegments = (path32) => {
+  const parts = path32.split("/").filter(Boolean);
+  return parts.map((part, index) => {
+    if (part === SPLAT && index === parts.length - 1) return { type: "splat" };
+    const match = part.match(/^:([\w-]+)(\?)?$/);
+    if (!match?.[1]) return { type: "static", value: part };
+    return { type: "param", name: match[1], optional: match[2] === "?" };
+  });
+};
+var getParamNames = (from) => parseSegments(from).flatMap((segment) => {
+  if (segment.type === "param") return [segment.name];
+  if (segment.type === "splat") return [SPLAT];
+  return [];
+});
+var isDynamicRedirect = (redirect) => getParamNames(redirect.from).length > 0;
+var replaceTokens = (to, names, replace) => {
+  const target = to.replace(TOKEN_REGEX, (token, name) => {
+    const key = name ?? SPLAT;
+    return names.includes(key) ? replace(key) : token;
+  });
+  const lostPath = target === "" || /^[?#]/.test(target);
+  return target !== to && lostPath ? `/${target}` : target;
+};
+var rankPath = (path32) => {
+  const segments = joinUrl(path32).split("/");
+  return segments.reduce(
+    (score, segment) => {
+      if (segment === SPLAT) return score;
+      if (segment.startsWith(":")) return score + 3;
+      return score + (segment === "" ? 1 : 10);
+    },
+    segments.length - (segments.includes(SPLAT) ? 2 : 0)
+  );
+};
+var segmentToPath = (segment) => {
+  if (segment.type === "static") return segment.value;
+  if (segment.type === "splat") return SPLAT;
+  return `:${segment.name}`;
+};
+var explodeOptional = (segments) => {
+  const [first, ...rest] = segments;
+  if (!first) return [[]];
+  const variants = explodeOptional(rest);
+  const withFirst = variants.map((variant) => [first, ...variant]);
+  return first.type === "param" && first.optional ? [...withFirst, ...variants] : withFirst;
+};
+var escapeRegex = (value) => value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+var toBuildOutputRedirects = (redirects, basePath) => {
+  const base = joinUrl(basePath);
+  const prefix = base === "/" ? "" : escapeRegex(base);
+  return redirects.flatMap((redirect) => {
+    const names = getParamNames(redirect.from);
+    const to = ABSOLUTE_URL_REGEX.test(redirect.to) ? redirect.to : joinUrl(basePath, redirect.to);
+    const toRoute = (segments) => {
+      const captured = segments.flatMap((segment) => {
+        if (segment.type === "param") return [segment.name];
+        if (segment.type === "splat") return [SPLAT];
+        return [];
+      });
+      const pattern = segments.map((segment) => {
+        if (segment.type === "static") {
+          return `/${escapeRegex(segment.value)}`;
+        }
+        return segment.type === "splat" ? "(/.+)" : "(/[^/]+)";
+      }).join("");
+      const endsWithSplat = segments.at(-1)?.type === "splat";
+      return {
+        // React Router accepts any number of trailing slashes
+        src: `^${prefix}${pattern}${endsWithSplat ? "" : "/*"}$`,
+        // Like React Router, a repeated param name takes the last value
+        location: replaceTokens(
+          to,
+          names,
+          (name) => captured.includes(name) ? `$${captured.lastIndexOf(name) + 1}` : ""
+        )
+      };
+    };
+    return explodeOptional(parseSegments(redirect.from)).flatMap(
+      (segments) => {
+        const rank = rankPath(`/${segments.map(segmentToPath).join("/")}`);
+        const variants = segments.at(-1)?.type === "splat" ? [segments, segments.slice(0, -1)] : [segments];
+        return variants.map((variant) => ({ rank, ...toRoute(variant) }));
+      }
+    );
+  }).toSorted((a, b) => b.rank - a.rank).map(({ src, location }) => ({ src, location }));
+};
+
 // src/vite/vercel-markdown-middleware.ts
 var normalizePath2 = (value) => {
   const pathname = value.split("/").filter(Boolean).map((segment) => {
@@ -9573,8 +9667,20 @@ function generateOutput({
       continue: true
     });
   }
-  if (rewrites.length > 0) {
+  const dynamicRedirects = toBuildOutputRedirects(
+    (config.redirects ?? []).filter(isDynamicRedirect),
+    config.basePath
+  );
+  if (rewrites.length > 0 || dynamicRedirects.length > 0) {
     routes.push({ handle: "filesystem" });
+    for (const { src, location } of dynamicRedirects) {
+      routes.push({
+        src,
+        dest: location,
+        status: 301,
+        headers: { Location: location }
+      });
+    }
     for (const rewrite of rewrites) {
       routes.push({
         src: joinUrl(config.basePath, rewrite.source),
@@ -9776,10 +9882,16 @@ var collectRewrites = (resolved) => resolved.flatMap((r) => [
   ...collectRewrites(r.children)
 ]);
 var routesToPaths = (routes) => collectPaths(resolveRoutes(routes), "");
+var withoutDynamicRedirectRoutes = (routes, redirects = []) => {
+  const paths = new Set(
+    redirects.filter(isDynamicRedirect).map(({ from }) => joinUrl(from))
+  );
+  return routes.filter((route) => !route.path || !paths.has(route.path));
+};
 var routesToPrerenderPaths = (routes, redirects = []) => Array.from(
   /* @__PURE__ */ new Set([
     ...routesToPaths(routes),
-    ...redirects.map(({ from }) => joinUrl(from))
+    ...redirects.filter((redirect) => !isDynamicRedirect(redirect)).map(({ from }) => joinUrl(from))
   ])
 );
 var routesToRewrites = (routes) => collectRewrites(resolveRoutes(routes));
@@ -9824,7 +9936,10 @@ var prerender = async ({
   const buildConfig = await getBuildConfig();
   const module = await import(entryServerPath);
   const getRoutes = module.getRoutesByConfig;
-  const routes = getRoutes(config);
+  const routes = withoutDynamicRedirectRoutes(
+    getRoutes(config),
+    config.redirects
+  );
   const paths = routesToPrerenderPaths(routes, config.redirects);
   const rewrites = routesToRewrites(routes);
   const { maxThreads, maxOldGenerationSizeMb } = getWorkerScaling(

package/dist/cli/worker.js

@@ -2514,6 +2514,7 @@ var ApiOptionsSchema = z4.object({
   supportedLanguages: z4.array(LanguageOption),
   disablePlayground: z4.boolean(),
   disableSidecar: z4.boolean(),
+  disableRequestBox: z4.boolean(),
   showVersionSelect: z4.enum(["always", "if-available", "hide"]),
   expandAllTags: z4.boolean(),
   showInfoPage: z4.boolean(),

package/dist/declarations/config/validators/ZudokuConfig.d.ts

@@ -49,6 +49,7 @@ declare const ApiOptionsSchema: z.ZodObject<{
     }, z.core.$strip>>>;
     disablePlayground: z.ZodOptional<z.ZodBoolean>;
     disableSidecar: z.ZodOptional<z.ZodBoolean>;
+    disableRequestBox: z.ZodOptional<z.ZodBoolean>;
     showVersionSelect: z.ZodOptional<z.ZodEnum<{
         always: "always";
         hide: "hide";
@@ -7741,6 +7742,7 @@ export declare const ZudokuConfig: z.ZodObject<{
             }, z.core.$strip>>>;
             disablePlayground: z.ZodOptional<z.ZodBoolean>;
             disableSidecar: z.ZodOptional<z.ZodBoolean>;
+            disableRequestBox: z.ZodOptional<z.ZodBoolean>;
             showVersionSelect: z.ZodOptional<z.ZodEnum<{
                 always: "always";
                 hide: "hide";
@@ -7778,6 +7780,7 @@ export declare const ZudokuConfig: z.ZodObject<{
             }, z.core.$strip>>>;
             disablePlayground: z.ZodOptional<z.ZodBoolean>;
             disableSidecar: z.ZodOptional<z.ZodBoolean>;
+            disableRequestBox: z.ZodOptional<z.ZodBoolean>;
             showVersionSelect: z.ZodOptional<z.ZodEnum<{
                 always: "always";
                 hide: "hide";
@@ -7819,6 +7822,7 @@ export declare const ZudokuConfig: z.ZodObject<{
             }, z.core.$strip>>>;
             disablePlayground: z.ZodOptional<z.ZodBoolean>;
             disableSidecar: z.ZodOptional<z.ZodBoolean>;
+            disableRequestBox: z.ZodOptional<z.ZodBoolean>;
             showVersionSelect: z.ZodOptional<z.ZodEnum<{
                 always: "always";
                 hide: "hide";
@@ -7852,6 +7856,7 @@ export declare const ZudokuConfig: z.ZodObject<{
             }, z.core.$strip>>>;
             disablePlayground: z.ZodOptional<z.ZodBoolean>;
             disableSidecar: z.ZodOptional<z.ZodBoolean>;
+            disableRequestBox: z.ZodOptional<z.ZodBoolean>;
             showVersionSelect: z.ZodOptional<z.ZodEnum<{
                 always: "always";
                 hide: "hide";
@@ -7889,6 +7894,7 @@ export declare const ZudokuConfig: z.ZodObject<{
             }, z.core.$strip>>>;
             disablePlayground: z.ZodOptional<z.ZodBoolean>;
             disableSidecar: z.ZodOptional<z.ZodBoolean>;
+            disableRequestBox: z.ZodOptional<z.ZodBoolean>;
             showVersionSelect: z.ZodOptional<z.ZodEnum<{
                 always: "always";
                 hide: "hide";
@@ -7930,6 +7936,7 @@ export declare const ZudokuConfig: z.ZodObject<{
             }, z.core.$strip>>>;
             disablePlayground: z.ZodOptional<z.ZodBoolean>;
             disableSidecar: z.ZodOptional<z.ZodBoolean>;
+            disableRequestBox: z.ZodOptional<z.ZodBoolean>;
             showVersionSelect: z.ZodOptional<z.ZodEnum<{
                 always: "always";
                 hide: "hide";
@@ -8032,6 +8039,7 @@ export declare const ZudokuConfig: z.ZodObject<{
             }, z.core.$strip>>>;
             disablePlayground: z.ZodOptional<z.ZodBoolean>;
             disableSidecar: z.ZodOptional<z.ZodBoolean>;
+            disableRequestBox: z.ZodOptional<z.ZodBoolean>;
             showVersionSelect: z.ZodOptional<z.ZodEnum<{
                 always: "always";
                 hide: "hide";

package/dist/declarations/lib/plugins/api-keys/fetchSigned.d.ts

@@ -0,0 +1,2 @@
+import type { ZudokuContext } from "../../core/ZudokuContext.js";
+export declare const fetchSigned: (context: ZudokuContext, request: Request) => Promise<Response>;

package/dist/declarations/lib/plugins/openapi/interfaces.d.ts

@@ -76,6 +76,7 @@ type BaseOasConfig = {
         }[];
         disablePlayground?: boolean;
         disableSidecar?: boolean;
+        disableRequestBox?: boolean;
         disableSecurity?: boolean;
         disableMcpAuthInstructions?: boolean;
         showVersionSelect?: "always" | "if-available" | "hide";

package/dist/declarations/lib/plugins/openapi/util/shouldShowRequestBox.d.ts

@@ -0,0 +1 @@
+export declare const shouldShowRequestBox: (extensions: Record<string, unknown> | null | undefined, disableRequestBox: boolean | undefined) => boolean;

package/dist/declarations/lib/util/redirectPattern.d.ts

@@ -0,0 +1,11 @@
+type Redirect = {
+    from: string;
+    to: string;
+};
+export declare const isDynamicRedirect: (redirect: Pick<Redirect, "from">) => boolean;
+export declare const resolveRedirectTarget: ({ from, to }: Redirect, params: Record<string, string | undefined>) => string;
+export declare const toBuildOutputRedirects: (redirects: readonly Redirect[], basePath?: string) => {
+    src: string;
+    location: string;
+}[];
+export {};

package/dist/flat-config.d.ts

@@ -538,6 +538,7 @@ export interface _Schema20 {
   }[]
   disablePlayground?: boolean
   disableSidecar?: boolean
+  disableRequestBox?: boolean
   showVersionSelect?: ("always" | "if-available" | "hide")
   expandAllTags?: boolean
   showInfoPage?: boolean

package/docs/configuration/api-reference.md

@@ -251,6 +251,7 @@ const config = {
       ],
       disablePlayground: false, // Disable the interactive API playground
       disableSidecar: false, // Disable the sidecar completely
+      disableRequestBox: false, // Hide the request box at the top of the sidecar
       disableSecurity: true, // Disable security scheme display and playground auth (default)
       disableMcpAuthInstructions: false, // Hide auth steps in the MCP server card
       showVersionSelect: "if-available", // Control version selector visibility
@@ -272,6 +273,11 @@ Available options:
   identifier) and `label` (display name)
 - `disablePlayground`: Disable the interactive API playground globally
 - `disableSidecar`: Disable the sidecar panel completely
+- `disableRequestBox`: Hide the request box at the top of the sidecar. The box holds the method and
+  path, the generated code snippet with its language selector, the auth selector and the button that
+  opens the playground, so hiding it also removes the way to open the playground. The request body
+  and response examples below it are still shown. Operations can override this with
+  [`x-zudoku-request-box-enabled`](../openapi-extensions/x-zudoku-request-box-enabled)
 - `disableSecurity`: Disable OpenAPI security scheme display (auth badges on operations, security
   schemes section on the info page, and the Authorize dialog in the playground). Disabled by default
   (`true`). Set to `false` to enable security scheme support
@@ -310,6 +316,7 @@ const config = {
       examplesLanguage: "shell", // Default language for code examples
       disablePlayground: false, // Disable the interactive API playground
       disableSidecar: false, // Disable the sidecar completely
+      disableRequestBox: false, // Hide the request box at the top of the sidecar
       disableSecurity: true, // Disable security scheme display and playground auth (default)
       disableMcpAuthInstructions: false, // Hide auth steps in the MCP server card
       showVersionSelect: "if-available", // Control version selector visibility
@@ -399,9 +406,14 @@ different levels of your API documentation.
 ### Operations
 
 - `x-zudoku-playground-enabled`: Control playground visibility for an operation (default: `true`)
+- `x-zudoku-request-box-enabled`: Control request box visibility in the sidecar for an operation
+  (default: `true`). See
+  [`x-zudoku-request-box-enabled`](../openapi-extensions/x-zudoku-request-box-enabled)
 - `x-internal`: Hide an operation from the documentation. Also works on path items and parameters.
   See [`x-internal`](../openapi-extensions/x-internal)
-- `x-explorer-enabled`: Alias for `x-zudoku-playground-enabled` for compatibility Example:
+- `x-explorer-enabled`: Alias for `x-zudoku-playground-enabled` for compatibility
+
+Example:
 
 ```json
 {
@@ -409,7 +421,8 @@ different levels of your API documentation.
     "/users": {
       "get": {
         "summary": "Get users",
-        "x-zudoku-playground-enabled": false // Disable playground for this operation
+        "x-zudoku-playground-enabled": false, // Disable playground for this operation
+        "x-zudoku-request-box-enabled": false // Hide the sidecar request box for this operation
       }
     }
   }

package/docs/configuration/authentication-auth0.md

@@ -50,21 +50,7 @@ If you don't have an Auth0 account, you can sign up for a
 
    Keep the default **Refresh Token Expiration** settings unless you have specific requirements.
 
-3. Create an Auth0 API:
-   - Navigate to the [APIs section](https://manage.auth0.com/#/apis) in the Auth0 dashboard
-   - Click **Create API**
-   - Set a name (e.g., "Zudoku API") and an identifier (e.g., `https://your-domain.com/api`)
-   - Choose **RS256** as the signing algorithm
-   - Save the API
-
-   :::warning
-
-   This step is important. If you skip creating an API, Zudoku will not be able to validate the
-   tokens issued by Auth0, leading to authentication failures.
-
-   :::
-
-4. **Configure Zudoku**
+3. **Configure Zudoku**
 
    Add the Auth0 configuration to your [Zudoku configuration file](./overview.md):
 
@@ -76,7 +62,6 @@ If you don't have an Auth0 account, you can sign up for a
        type: "auth0",
        domain: "your-domain.us.auth0.com",
        clientId: "<your-auth0-client-id>",
-       audience: "https://your-domain.com/api", // Your Auth0 API identifier
      },
      // ... other configuration
    };
@@ -85,7 +70,36 @@ If you don't have an Auth0 account, you can sign up for a
    Where:
    - **domain**: Your Auth0 domain (found in your application's Basic Information)
    - **clientId**: The Client ID from your Auth0 application settings
-   - **audience**: The identifier of the Auth0 API you created (e.g., `https://your-domain.com/api`)
+
+4. **(Optional) Configure an audience for API access**
+
+   Only configure an `audience` if you need the access token to call a specific API (for example,
+   when using the API playground to send authenticated requests to your backend). Without an
+   audience, Auth0 issues an opaque token that can be used to identify the user via `/userinfo` —
+   which is all Zudoku needs for sign-in and protected routes.
+
+   :::tip
+
+   Avoid setting an audience when you don't need it. Issuing an access token scoped to an API when
+   it isn't going to call that API gives the token broader privileges than necessary.
+
+   :::
+
+   If you do need API access:
+   - Navigate to the [APIs section](https://manage.auth0.com/#/apis) in the Auth0 dashboard
+   - Click **Create API**, set a name (e.g., "Zudoku API") and an identifier (e.g.,
+     `https://your-domain.com/api`)
+   - Choose **RS256** as the signing algorithm and save the API
+   - Add the identifier to your Zudoku configuration:
+
+   ```typescript
+   authentication: {
+     type: "auth0",
+     domain: "your-domain.us.auth0.com",
+     clientId: "<your-auth0-client-id>",
+     audience: "https://your-domain.com/api", // Your Auth0 API identifier
+   }
+   ```
 
 </Stepper>
 
@@ -188,8 +202,9 @@ authentication: {
 3. **Authentication Loop**: Check that your Auth0 domain is a plain hostname only (e.g.,
    `your-domain.us.auth0.com`) without a protocol prefix (`https://`) or trailing slash.
 
-4. **Token Validation Errors**: Ensure the audience in your Zudoku configuration matches the
-   identifier of the Auth0 API you created.
+4. **Token Validation Errors**: If you've configured an `audience`, make sure it matches the
+   identifier of the Auth0 API you created. If you don't need to call an API, remove `audience` from
+   your configuration — Auth0 will issue an opaque token suitable for `/userinfo`.
 
 ## Next Steps
 

package/docs/configuration/overview.md

@@ -284,12 +284,16 @@ URL.
   // ...
   "redirects": [
     { "from": "/", "to": "/documentation/introduction" },
-    { "from": "/documentation", "to": "/documentation/introduction" }
+    { "from": "/documentation", "to": "/documentation/introduction" },
+    { "from": "/blog/:slug", "to": "/posts/:slug" }
   ]
   // ...
 }
 ```
 
+`from` paths can contain `:param` segments and a trailing `*` wildcard. See
+[Redirects](/docs/guides/redirects#path-parameters-and-wildcards) for details.
+
 ### `port`
 
 The port on which the development server will run. Defaults to `3000`. This option can also be

package/docs/guides/managing-api-keys-and-identities.md

@@ -35,6 +35,14 @@ this is already enabled.)
 
 This will make the API Key UI available at `/settings/api-keys` in your Zudoku.
 
+:::note
+
+Zuplo's API key service identifies users by their JWT access token. If you use
+[Auth0](../configuration/authentication-auth0.md), configure an `audience` in your authentication
+settings. Without one, Auth0 issues an opaque access token that can't be used to manage API keys.
+
+:::
+
 ### Creating API Keys
 
 By default, there is no **Create API Key** Button. To get the button working you have to implement

package/docs/guides/redirects.md

@@ -52,6 +52,43 @@ redirects: [{ from: "/old-page", to: "/new-page" }];
 Trailing slashes in the `from` path are normalized automatically. Both `/old-page` and `/old-page/`
 will match the same redirect rule.
 
+## Path parameters and wildcards
+
+A `from` path can match more than one URL. Use `:name` for a single path segment and a trailing `*`
+for everything after a prefix. Reference the same tokens in `to` to carry the matched values over:
+
+```ts
+redirects: [
+  // /blog/hello-world → /posts/hello-world
+  { from: "/blog/:slug", to: "/posts/:slug" },
+  // /v1/guides/auth/tokens → /guides/auth/tokens
+  { from: "/v1/*", to: "/*" },
+  // /dashboard/apps/42 → https://dashboard.example.com/apps/42
+  { from: "/dashboard/*", to: "https://dashboard.example.com/*" },
+];
+```
+
+- **`:name`** matches exactly one segment. Add `?` (`:name?`) to make it optional.
+- **`*`** must be the last segment of `from`. It also matches the prefix itself, so `/dashboard/*`
+  redirects `/dashboard` too. In that case the `/*` in `to` is dropped, leaving `/` if nothing else
+  remains.
+- In `to`, `/:name` and `/*` must each fill a whole path segment, so `/posts/:slug` works and
+  `/posts-:slug` doesn't. Tokens that don't appear in `from` are left as they are.
+- Zudoku doesn't copy the incoming query string to the target.
+
+Pages in your portal take precedence over a wildcard redirect, so `{ from: "/docs/*", to: "/" }`
+still lets visitors reach `/docs/introduction` if that page exists.
+
+Static hosts can't prerender a file for every URL a pattern matches, so pattern redirects behave
+differently from exact ones:
+
+- **Zuplo** and **Vercel**: Zudoku turns the pattern into a regular-expression route in the build
+  output, and the platform returns an HTTP **301**.
+- **SSR deployments**: the server returns an HTTP 301, the same as exact redirects.
+- **Other static hosts**: no redirect file is written. If your host serves `404.html` (or your app's
+  `index.html`) for unknown paths, the page loads, Zudoku matches the pattern, and the browser is
+  redirected. Otherwise, set up the redirect in your host's own configuration.
+
 ## How redirects work
 
 Zudoku redirects operate at two levels depending on how the visitor reaches the page:

package/docs/openapi-extensions/x-zudoku-request-box-enabled.md

@@ -0,0 +1,47 @@
+---
+title: x-zudoku-request-box-enabled
+sidebar_icon: square-code
+---
+
+Use `x-zudoku-request-box-enabled` to show or hide the request box at the top of an operation's
+sidecar for a specific operation. By default, the request box is shown for all operations unless
+globally disabled via the [`disableRequestBox`](/docs/configuration/api-reference) option.
+
+The request box holds the method and path, the generated code snippet (or your
+[`x-code-samples`](./x-code-samples)) with its language selector, the auth selector and the button
+that opens the playground. Hiding it also removes the way to open the playground for that operation.
+The request body and response examples below it are still shown.
+
+## Location
+
+The extension is added at the **Operation Object** level.
+
+| Option                         | Type      | Description                                      |
+| ------------------------------ | --------- | ------------------------------------------------ |
+| `x-zudoku-request-box-enabled` | `boolean` | Show (`true`) or hide (`false`) the request box. |
+
+If the extension is not set, the request box visibility falls back to the global `disableRequestBox`
+configuration.
+
+## Example
+
+```yaml
+paths:
+  /users:
+    get:
+      summary: List users
+      x-zudoku-request-box-enabled: true
+      responses:
+        "200":
+          description: Successful response
+  /webhooks/trigger:
+    post:
+      summary: Trigger webhook
+      x-zudoku-request-box-enabled: false
+      responses:
+        "200":
+          description: Accepted
+```
+
+In this example, `List users` shows the request box while `Trigger webhook` hides it regardless of
+the global setting.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zudoku",
-  "version": "0.91.0",
+  "version": "0.93.0",
   "type": "module",
   "engines": {
     "node": ">=22.22.0"

package/src/app/utils/createRedirectRoutes.ts

@@ -1,11 +1,12 @@
 import { redirect, type RouteObject } from "react-router";
 import type { ZudokuRedirect } from "../../config/validators/ZudokuConfig.js";
 import { joinUrl } from "../../lib/util/joinUrl.js";
+import { resolveRedirectTarget } from "../../lib/util/redirectPattern.js";
 
 export const createRedirectRoutes = (
   redirects?: ZudokuRedirect[],
 ): RouteObject[] =>
   (redirects ?? []).map((r) => ({
     path: joinUrl(r.from),
-    loader: () => redirect(r.to, 301),
+    loader: ({ params }) => redirect(resolveRedirectTarget(r, params), 301),
   }));

package/src/config/validators/ZudokuConfig.ts

@@ -93,6 +93,7 @@ const ApiOptionsSchema = z
     supportedLanguages: z.array(LanguageOption),
     disablePlayground: z.boolean(),
     disableSidecar: z.boolean(),
+    disableRequestBox: z.boolean(),
     showVersionSelect: z.enum(["always", "if-available", "hide"]),
     expandAllTags: z.boolean(),
     showInfoPage: z.boolean(),

package/src/lib/authentication/providers/openid.tsx

@@ -17,7 +17,7 @@ import { LogoutCallbackHandler } from "../components/LogoutCallbackHandler.js";
 import { OAuthErrorPage } from "../components/OAuthErrorPage.js";
 import { fetchServerSession } from "../cookie-sync.js";
 import { DEFAULT_SESSION_MAX_AGE, SESSION_ENDPOINT_PATH } from "../cookies.js";
-import { AuthorizationError, OAuthAuthorizationError } from "../errors.js";
+import { AuthorizationError } from "../errors.js";
 import { type UserProfile, useAuthState } from "../state.js";
 import { redirectToSignUpUrl } from "./util.js";
 
@@ -178,19 +178,6 @@ export class OpenIDAuthenticationProvider
       throw new AuthorizationError("No expires_in in response");
     }
 
-    const accessToken = response.access_token;
-    if (accessToken.split(".").length !== 3) {
-      throw new OAuthAuthorizationError(
-        "The access token received is not a valid JWT.",
-        {
-          error: "configuration_error",
-          error_description:
-            "The authentication provider is issuing opaque tokens instead of JWTs. " +
-            "Ensure you have configured the correct `audience` in your authentication settings.",
-        },
-      );
-    }
-
     const claims = response.id_token
       ? oauth.getValidatedIdTokenClaims(response)
       : undefined;

package/src/lib/plugins/api-keys/fetchSigned.ts

@@ -0,0 +1,35 @@
+import type { ZudokuContext } from "../../core/ZudokuContext.js";
+import { ZudokuError } from "../../util/invariant.js";
+
+const isJwt = (token: string) => token.split(".").length === 3;
+
+const isAuthFailure = (response: Response) =>
+  response.status === 401 || response.status === 403;
+
+/**
+ * Signs and sends a request to Zuplo's API key service. The service identifies
+ * the user from a JWT access token, so an opaque token (e.g. Auth0 without an
+ * `audience`) rejected with 401/403 is reported as a configuration error
+ * instead of a generic request failure.
+ */
+export const fetchSigned = async (context: ZudokuContext, request: Request) => {
+  const signedRequest = await context.signRequest(request);
+  const response = await fetch(signedRequest);
+
+  const accessToken = signedRequest.headers
+    .get("Authorization")
+    ?.replace(/^Bearer /i, "");
+
+  if (isAuthFailure(response) && accessToken && !isJwt(accessToken)) {
+    throw new ZudokuError(
+      "The access token issued by the authentication provider can't be used to manage API keys.",
+      {
+        title: "Configuration Error",
+        developerHint:
+          "Zuplo API key management requires a JWT access token, but the authentication provider issued an opaque token. If you use Auth0, set `audience` in your authentication configuration to the identifier of your Auth0 API.",
+      },
+    );
+  }
+
+  return response;
+};

package/src/lib/plugins/api-keys/index.tsx

@@ -11,6 +11,7 @@ import type { ZudokuContext } from "../../core/ZudokuContext.js";
 import invariant from "../../util/invariant.js";
 import { joinUrl } from "../../util/joinUrl.js";
 import { throwIfProblemJson } from "../../util/problemJson.js";
+import { fetchSigned } from "./fetchSigned.js";
 import { SettingsApiKeys } from "./SettingsApiKeys.js";
 
 const DEFAULT_GATEWAY_URL = "https://api.zuploedge.com";
@@ -93,7 +94,7 @@ const createZuploService = ({
           method: "DELETE",
         },
       );
-      const response = await fetch(await context.signRequest(request));
+      const response = await fetchSigned(context, request);
       await throwIfProblemJson(response);
       invariant(response.ok, "Failed to delete API key");
     },
@@ -103,23 +104,22 @@ const createZuploService = ({
         "Cannot update API key description.",
         developerHintOptions,
       );
-      const response = await fetch(
-        await context.signRequest(
-          new Request(
-            joinUrl(
-              getApiKeyEndpoint(context),
-              `${deploymentName}/consumers/${consumer.id}`,
-            ),
-            {
-              method: "PATCH",
-              headers: {
-                "Content-Type": "application/json",
-              },
-              body: JSON.stringify({
-                label: consumer.label,
-              }),
-            },
+      const response = await fetchSigned(
+        context,
+        new Request(
+          joinUrl(
+            getApiKeyEndpoint(context),
+            `${deploymentName}/consumers/${consumer.id}`,
           ),
+          {
+            method: "PATCH",
+            headers: {
+              "Content-Type": "application/json",
+            },
+            body: JSON.stringify({
+              label: consumer.label,
+            }),
+          },
         ),
       );
       await throwIfProblemJson(response);
@@ -127,21 +127,20 @@ const createZuploService = ({
     },
     rollKey: async (consumerId, context) => {
       invariant(deploymentName, "Cannot roll API key.", developerHintOptions);
-      const response = await fetch(
-        await context.signRequest(
-          new Request(
-            joinUrl(
-              getApiKeyEndpoint(context),
-              `${deploymentName}/consumers/${consumerId}/roll-key`,
-            ),
-            {
-              method: "POST",
-              headers: {
-                "Content-Type": "application/json",
-              },
-              body: JSON.stringify({}),
-            },
+      const response = await fetchSigned(
+        context,
+        new Request(
+          joinUrl(
+            getApiKeyEndpoint(context),
+            `${deploymentName}/consumers/${consumerId}/roll-key`,
           ),
+          {
+            method: "POST",
+            headers: {
+              "Content-Type": "application/json",
+            },
+            body: JSON.stringify({}),
+          },
         ),
       );
       await throwIfProblemJson(response);
@@ -152,9 +151,7 @@ const createZuploService = ({
       const request = new Request(
         joinUrl(getApiKeyEndpoint(context), `${deploymentName}/consumers`),
       );
-      await context.signRequest(request);
-
-      const keys = await fetch(request);
+      const keys = await fetchSigned(context, request);
       await throwIfProblemJson(keys);
       invariant(keys.ok, "Failed to fetch API keys");
 

package/src/lib/plugins/openapi/Sidecar.tsx

@@ -33,6 +33,7 @@ import {
 import { generateSchemaExample } from "./util/generateSchemaExample.js";
 import { getGraphQLEndpoint } from "./util/graphqlEndpoint.js";
 import { methodForColor } from "./util/methodToColor.js";
+import { shouldShowRequestBox } from "./util/shouldShowRequestBox.js";
 import { useResolvedAuth } from "./util/useResolvedAuth.js";
 
 export const GetServerQuery = graphql(/* GraphQL */ `
@@ -221,7 +222,14 @@ export const Sidecar = ({
   const graphQLEndpoint = getGraphQLEndpoint(operation);
   const isGraphQLEndpoint = graphQLEndpoint !== undefined;
 
+  const showRequestBox = shouldShowRequestBox(
+    operation.extensions,
+    options?.disableRequestBox,
+  );
+
   const httpSnippetCode = useMemo<string | undefined>(() => {
+    if (!showRequestBox) return;
+
     if (codeSamples && !hasResolvedAuth) {
       const match = codeSamples.find((s) => s.lang === selectedLang);
       return match?.source;
@@ -258,6 +266,7 @@ export const Sidecar = ({
 
     return getConverted(snippet, selectedLang);
   }, [
+    showRequestBox,
     codeSamples,
     currentExampleCode,
     operation,
@@ -331,82 +340,84 @@ export const Sidecar = ({
       className="flex flex-col sticky top-(--scroll-padding) gap-4"
       data-pagefind-ignore="all"
     >
-      <SidecarBox.Root>
-        <SidecarBox.Head className="py-1.5">
-          <div className="flex items-center flex-wrap gap-2 justify-between w-full">
-            <span className="font-mono wrap-break-word leading-6 space-x-1">
-              <Badge
-                variant="outline"
-                className={cn(
-                  methodTextColor,
-                  "px-1.5 rounded-md border-none bg-current/7 dark:bg-current/15",
-                )}
-              >
-                {operation.method.toUpperCase()}
-              </Badge>
-              {path}
-            </span>
-            {showPlayground &&
-              (isGraphQLEndpoint ? (
-                <GraphiQLDialog
-                  endpoint={graphQLEndpoint?.endpoint ?? operationUrl}
-                  operation={operation}
-                  securitySchemes={securitySchemes}
-                  defaultTabs={
-                    graphQLTabs && graphQLTabs.length > 0
-                      ? graphQLTabs
-                      : undefined
-                  }
-                />
-              ) : (
-                <PlaygroundDialogWrapper
-                  servers={operation.servers}
-                  operation={operation}
-                  examples={requestBodyContent ?? undefined}
-                />
+      {showRequestBox && (
+        <SidecarBox.Root>
+          <SidecarBox.Head className="py-1.5">
+            <div className="flex items-center flex-wrap gap-2 justify-between w-full">
+              <span className="font-mono wrap-break-word leading-6 space-x-1">
+                <Badge
+                  variant="outline"
+                  className={cn(
+                    methodTextColor,
+                    "px-1.5 rounded-md border-none bg-current/7 dark:bg-current/15",
+                  )}
+                >
+                  {operation.method.toUpperCase()}
+                </Badge>
+                {path}
+              </span>
+              {showPlayground &&
+                (isGraphQLEndpoint ? (
+                  <GraphiQLDialog
+                    endpoint={graphQLEndpoint?.endpoint ?? operationUrl}
+                    operation={operation}
+                    securitySchemes={securitySchemes}
+                    defaultTabs={
+                      graphQLTabs && graphQLTabs.length > 0
+                        ? graphQLTabs
+                        : undefined
+                    }
+                  />
+                ) : (
+                  <PlaygroundDialogWrapper
+                    servers={operation.servers}
+                    operation={operation}
+                    examples={requestBodyContent ?? undefined}
+                  />
+                ))}
+            </div>
+          </SidecarBox.Head>
+          <SidecarBox.Body>
+            {shouldLazyHighlight && !isOnScreen ? (
+              <NonHighlightedCode code={httpSnippetCode ?? ""} />
+            ) : (
+              <SyntaxHighlight
+                embedded
+                language={selectedLang}
+                showLanguageIndicator={false}
+                className="[--scrollbar-color:gray] rounded-none text-xs max-h-50"
+                // biome-ignore lint/style/noNonNullAssertion: code is guaranteed to be defined
+                code={httpSnippetCode!}
+              />
+            )}
+          </SidecarBox.Body>
+          <SidecarBox.Footer className="text-xs self-end flex justify-between items-center gap-2">
+            <NativeSelect
+              className="text-xs h-fit py-1 max-w-32 truncate bg-background"
+              value={selectedLang}
+              onChange={(e) => {
+                startTransition(() => {
+                  setSearchParams((prev) => {
+                    prev.set("lang", e.target.value);
+                    return prev;
+                  });
+                });
+              }}
+            >
+              {supportedLanguages.map((language) => (
+                <NativeSelectOption key={language.value} value={language.value}>
+                  {language.label}
+                </NativeSelectOption>
               ))}
-          </div>
-        </SidecarBox.Head>
-        <SidecarBox.Body>
-          {shouldLazyHighlight && !isOnScreen ? (
-            <NonHighlightedCode code={httpSnippetCode ?? ""} />
-          ) : (
-            <SyntaxHighlight
-              embedded
-              language={selectedLang}
-              showLanguageIndicator={false}
-              className="[--scrollbar-color:gray] rounded-none text-xs max-h-50"
-              // biome-ignore lint/style/noNonNullAssertion: code is guaranteed to be defined
-              code={httpSnippetCode!}
+            </NativeSelect>
+            <AuthSelectorPopover
+              operation={operation}
+              url={operationUrl}
+              securitySchemes={securitySchemes}
             />
-          )}
-        </SidecarBox.Body>
-        <SidecarBox.Footer className="text-xs self-end flex justify-between items-center gap-2">
-          <NativeSelect
-            className="text-xs h-fit py-1 max-w-32 truncate bg-background"
-            value={selectedLang}
-            onChange={(e) => {
-              startTransition(() => {
-                setSearchParams((prev) => {
-                  prev.set("lang", e.target.value);
-                  return prev;
-                });
-              });
-            }}
-          >
-            {supportedLanguages.map((language) => (
-              <NativeSelectOption key={language.value} value={language.value}>
-                {language.label}
-              </NativeSelectOption>
-            ))}
-          </NativeSelect>
-          <AuthSelectorPopover
-            operation={operation}
-            url={operationUrl}
-            securitySchemes={securitySchemes}
-          />
-        </SidecarBox.Footer>
-      </SidecarBox.Root>
+          </SidecarBox.Footer>
+        </SidecarBox.Root>
+      )}
 
       {transformedRequestBodyContent && currentExample ? (
         <RequestBodySidecarBox

package/src/lib/plugins/openapi/interfaces.ts

@@ -88,6 +88,7 @@ type BaseOasConfig = {
     supportedLanguages?: { value: string; label: string }[];
     disablePlayground?: boolean;
     disableSidecar?: boolean;
+    disableRequestBox?: boolean;
     disableSecurity?: boolean;
     disableMcpAuthInstructions?: boolean;
     showVersionSelect?: "always" | "if-available" | "hide";

package/src/lib/plugins/openapi/util/shouldShowRequestBox.ts

@@ -0,0 +1,18 @@
+/**
+ * Decides whether the request box (method and path, code snippet, language
+ * selector, playground button and auth selector) is shown at the top of an
+ * operation's sidecar.
+ *
+ * - `x-zudoku-request-box-enabled: true` shows it, even if the API sets
+ *   `disableRequestBox`.
+ * - Any other explicit value hides it, matching `x-zudoku-playground-enabled`.
+ * - When unset (`undefined`), it falls back to the API's `disableRequestBox`.
+ */
+export const shouldShowRequestBox = (
+  extensions: Record<string, unknown> | null | undefined,
+  disableRequestBox: boolean | undefined,
+) => {
+  const enabled = extensions?.["x-zudoku-request-box-enabled"];
+  if (enabled === undefined) return !disableRequestBox;
+  return enabled === true;
+};

package/src/lib/util/redirectPattern.ts

@@ -0,0 +1,172 @@
+import { joinUrl } from "./joinUrl.js";
+
+type Redirect = { from: string; to: string };
+
+type Segment =
+  | { type: "static"; value: string }
+  | { type: "param"; name: string; optional: boolean }
+  | { type: "splat" };
+
+const SPLAT = "*";
+// React Router's own check for URLs that leave the app
+const ABSOLUTE_URL_REGEX = /^(?:[a-z][a-z0-9+.-]*:|[\\/]{2})/i;
+// A `/:param` or `/*` token that spans a whole path segment
+const TOKEN_REGEX = /\/(?::([\w-]+)|\*)(?=[/?#]|$)/g;
+
+// Parses a `from` path using React Router's syntax: `:param`, `:param?` and a
+// trailing `*` splat.
+const parseSegments = (path: string): Segment[] => {
+  const parts = path.split("/").filter(Boolean);
+  return parts.map((part, index): Segment => {
+    if (part === SPLAT && index === parts.length - 1) return { type: "splat" };
+    const match = part.match(/^:([\w-]+)(\?)?$/);
+    if (!match?.[1]) return { type: "static", value: part };
+    return { type: "param", name: match[1], optional: match[2] === "?" };
+  });
+};
+
+const getParamNames = (from: string) =>
+  parseSegments(from).flatMap((segment) => {
+    if (segment.type === "param") return [segment.name];
+    if (segment.type === "splat") return [SPLAT];
+    return [];
+  });
+
+export const isDynamicRedirect = (redirect: Pick<Redirect, "from">) =>
+  getParamNames(redirect.from).length > 0;
+
+// Replaces the `/:param` and `/*` tokens in `to` that `from` defines. Tokens
+// unknown to `from` are left untouched. Removing empty params can leave no path
+// at all (`/*` for `/v1/*` at `/v1`), which would redirect back to the same
+// URL, so that falls back to the root. A `to` without replaced tokens is kept
+// as written, so relative targets like `?tab=2` still work.
+const replaceTokens = (
+  to: string,
+  names: string[],
+  replace: (name: string) => string,
+) => {
+  const target = to.replace(TOKEN_REGEX, (token, name: string | undefined) => {
+    const key = name ?? SPLAT;
+    return names.includes(key) ? replace(key) : token;
+  });
+  const lostPath = target === "" || /^[?#]/.test(target);
+  return target !== to && lostPath ? `/${target}` : target;
+};
+
+const encodeParam = (name: string, value: string) =>
+  name === SPLAT
+    ? value.split("/").map(encodeURIComponent).join("/")
+    : encodeURIComponent(value);
+
+/**
+ * Builds the redirect target for a matched `from` path by substituting the
+ * matched params into `to`, e.g. `{ from: "/blog/:slug", to: "/posts/:slug" }`
+ * sends `/blog/hello` to `/posts/hello`. Empty params drop their segment.
+ */
+export const resolveRedirectTarget = (
+  { from, to }: Redirect,
+  params: Record<string, string | undefined>,
+) =>
+  replaceTokens(to, getParamNames(from), (name) => {
+    const value = params[name];
+    return value ? `/${encodeParam(name, value)}` : "";
+  });
+
+// Mirrors React Router's `computeScore` for a concrete (non-optional) path.
+const rankPath = (path: string) => {
+  const segments = joinUrl(path).split("/");
+  return segments.reduce(
+    (score, segment) => {
+      if (segment === SPLAT) return score;
+      if (segment.startsWith(":")) return score + 3;
+      return score + (segment === "" ? 1 : 10);
+    },
+    segments.length - (segments.includes(SPLAT) ? 2 : 0),
+  );
+};
+
+const segmentToPath = (segment: Segment) => {
+  if (segment.type === "static") return segment.value;
+  if (segment.type === "splat") return SPLAT;
+  return `:${segment.name}`;
+};
+
+// React Router ranks each concrete variant of a path with optional segments,
+// in this order: `/:a?/:b?` becomes `/:a/:b`, `/:a`, `/:b` and `/`.
+const explodeOptional = (segments: Segment[]): Segment[][] => {
+  const [first, ...rest] = segments;
+  if (!first) return [[]];
+  const variants = explodeOptional(rest);
+  const withFirst = variants.map((variant) => [first, ...variant]);
+  return first.type === "param" && first.optional
+    ? [...withFirst, ...variants]
+    : withFirst;
+};
+
+const escapeRegex = (value: string) =>
+  value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+
+/**
+ * Converts dynamic redirects into Build Output API routes. Each concrete
+ * variant of a `from` path becomes a regex with one capture group per param
+ * (including its leading slash), and the tokens in `to` become the matching
+ * `$n` references. Build Output routes match top to bottom, so they are sorted
+ * the way React Router ranks the same paths, keeping configuration order for
+ * ties.
+ */
+export const toBuildOutputRedirects = (
+  redirects: readonly Redirect[],
+  basePath?: string,
+) => {
+  const base = joinUrl(basePath);
+  const prefix = base === "/" ? "" : escapeRegex(base);
+
+  return redirects
+    .flatMap((redirect) => {
+      const names = getParamNames(redirect.from);
+      const to = ABSOLUTE_URL_REGEX.test(redirect.to)
+        ? redirect.to
+        : joinUrl(basePath, redirect.to);
+
+      const toRoute = (segments: Segment[]) => {
+        const captured = segments.flatMap((segment) => {
+          if (segment.type === "param") return [segment.name];
+          if (segment.type === "splat") return [SPLAT];
+          return [];
+        });
+        const pattern = segments
+          .map((segment) => {
+            if (segment.type === "static") {
+              return `/${escapeRegex(segment.value)}`;
+            }
+            return segment.type === "splat" ? "(/.+)" : "(/[^/]+)";
+          })
+          .join("");
+        const endsWithSplat = segments.at(-1)?.type === "splat";
+
+        return {
+          // React Router accepts any number of trailing slashes
+          src: `^${prefix}${pattern}${endsWithSplat ? "" : "/*"}$`,
+          // Like React Router, a repeated param name takes the last value
+          location: replaceTokens(to, names, (name) =>
+            captured.includes(name) ? `$${captured.lastIndexOf(name) + 1}` : "",
+          ),
+        };
+      };
+
+      return explodeOptional(parseSegments(redirect.from)).flatMap(
+        (segments) => {
+          const rank = rankPath(`/${segments.map(segmentToPath).join("/")}`);
+          // An empty splat gets its own route so its target is resolved here
+          // rather than from an empty `$n` at request time
+          const variants =
+            segments.at(-1)?.type === "splat"
+              ? [segments, segments.slice(0, -1)]
+              : [segments];
+          return variants.map((variant) => ({ rank, ...toRoute(variant) }));
+        },
+      );
+    })
+    .toSorted((a, b) => b.rank - a.rank)
+    .map(({ src, location }) => ({ src, location }));
+};

package/src/vite/output.ts

@@ -6,6 +6,10 @@ import { getZudokuPackageJson } from "../cli/common/package-json.js";
 import type { LoadedConfig } from "../config/config.js";
 import invariant from "../lib/util/invariant.js";
 import { joinUrl } from "../lib/util/joinUrl.js";
+import {
+  isDynamicRedirect,
+  toBuildOutputRedirects,
+} from "../lib/util/redirectPattern.js";
 import type { RouteRewrite } from "./prerender/utils.js";
 import {
   generateVercelMarkdownMiddleware,
@@ -200,8 +204,23 @@ export function generateOutput({
     });
   }
 
-  if (rewrites.length > 0) {
+  // Dynamic redirects can't be prerendered, so match them with a regex. They
+  // run after the filesystem so real pages win, like React Router's ranking.
+  const dynamicRedirects = toBuildOutputRedirects(
+    (config.redirects ?? []).filter(isDynamicRedirect),
+    config.basePath,
+  );
+
+  if (rewrites.length > 0 || dynamicRedirects.length > 0) {
     routes.push({ handle: "filesystem" });
+    for (const { src, location } of dynamicRedirects) {
+      routes.push({
+        src,
+        dest: location,
+        status: 301,
+        headers: { Location: location },
+      });
+    }
     for (const rewrite of rewrites) {
       routes.push({
         src: joinUrl(config.basePath, rewrite.source),

package/src/vite/plugin-api.ts

@@ -52,6 +52,7 @@ export const generateDefaultApiOptionsCode = () => [
   `  supportedLanguages: config.defaults?.apis?.supportedLanguages,`,
   `  disablePlayground: config.defaults?.apis?.disablePlayground,`,
   `  disableSidecar: config.defaults?.apis?.disableSidecar,`,
+  `  disableRequestBox: config.defaults?.apis?.disableRequestBox,`,
   `  disableSecurity: config.defaults?.apis?.disableSecurity ?? true,`,
   `  disableMcpAuthInstructions: config.defaults?.apis?.disableMcpAuthInstructions,`,
   `  showVersionSelect: config.defaults?.apis?.showVersionSelect ?? "if-available",`,

package/src/vite/prerender/prerender.ts

@@ -23,6 +23,7 @@ import { generateSitemap } from "../sitemap.js";
 import {
   routesToPrerenderPaths,
   routesToRewrites,
+  withoutDynamicRedirectRoutes,
   selectPagesToIndex,
 } from "./utils.js";
 import type { StaticWorkerData, WorkerData } from "./worker.js";
@@ -87,7 +88,10 @@ export const prerender = async ({
   const module = await import(entryServerPath);
   const getRoutes = module.getRoutesByConfig as typeof getRoutesByConfig;
 
-  const routes = getRoutes(config);
+  const routes = withoutDynamicRedirectRoutes(
+    getRoutes(config),
+    config.redirects,
+  );
   const paths = routesToPrerenderPaths(routes, config.redirects);
   const rewrites = routesToRewrites(routes);
   const { maxThreads, maxOldGenerationSizeMb } = getWorkerScaling(

package/src/vite/prerender/utils.ts

@@ -1,5 +1,6 @@
 import type { RouteObject } from "react-router";
 import { joinUrl } from "../../lib/util/joinUrl.js";
+import { isDynamicRedirect } from "../../lib/util/redirectPattern.js";
 
 const resolveRoutePath = (path: string): string | undefined => {
   const segments = path.split("/");
@@ -72,6 +73,20 @@ const collectRewrites = (resolved: ResolvedRoute[]): RouteRewrite[] =>
 export const routesToPaths = (routes: RouteObject[]): string[] =>
   collectPaths(resolveRoutes(routes), "");
 
+// Dynamic redirects (`/:param`, `/*`) can't be prerendered to a file; they are
+// emitted as Build Output API routes instead (see `generateOutput`). Their
+// top-level route objects are dropped so optional params don't get stripped
+// into a prerendered path and rewrite.
+export const withoutDynamicRedirectRoutes = (
+  routes: RouteObject[],
+  redirects: readonly { from: string }[] = [],
+): RouteObject[] => {
+  const paths = new Set(
+    redirects.filter(isDynamicRedirect).map(({ from }) => joinUrl(from)),
+  );
+  return routes.filter((route) => !route.path || !paths.has(route.path));
+};
+
 export const routesToPrerenderPaths = (
   routes: RouteObject[],
   redirects: readonly { from: string }[] = [],
@@ -79,7 +94,9 @@ export const routesToPrerenderPaths = (
   Array.from(
     new Set([
       ...routesToPaths(routes),
-      ...redirects.map(({ from }) => joinUrl(from)),
+      ...redirects
+        .filter((redirect) => !isDynamicRedirect(redirect))
+        .map(({ from }) => joinUrl(from)),
     ]),
   );