blume 2.0.1 → 2.0.2

package/src/core/ui-packs/sv.ts

@@ -44,9 +44,20 @@ export const sv: UIStringsOverride = {
     title: "Ändringslogg",
   },
   content: {
+    code: "Kod",
     copyColor: "Kopiera färgen {name} {value}",
     copyPrompt: "Kopiera prompt",
+    default: "Standard",
     diagramError: "Det här diagrammet kunde inte visas.",
+    forks: "Forkar",
+    preview: "Förhandsgranskning",
+    prop: "Egenskap",
+    selectTab: "Välj flik",
+    showMore: "Visa mer",
+    stars: "Stjärnor",
+    tab: "Flik {n}",
+    type: "Typ",
+    update: "Uppdatering",
   },
   feedback: {
     no: "Nej",
@@ -88,8 +99,10 @@ export const sv: UIStringsOverride = {
     assistantHint: "Få ett omedelbart svar från AI",
     button: "Sök",
     devOnly: "Sökning är tillgänglig i produktionsbygget.",
+    docs: "Dokumentation",
     error: "Något gick fel. Försök igen.",
     label: "Sök i dokumentationen",
+    latest: "senaste",
     navigate: "navigera",
     noResults: "Inga resultat hittades.",
     open: "öppna",

package/src/core/ui-packs/th.ts

@@ -43,9 +43,20 @@ export const th: UIStringsOverride = {
     title: "บันทึกการเปลี่ยนแปลง",
   },
   content: {
+    code: "โค้ด",
     copyColor: "คัดลอกสี {name} {value}",
     copyPrompt: "คัดลอกพรอมต์",
+    default: "ค่าเริ่มต้น",
     diagramError: "ไม่สามารถแสดงไดอะแกรมนี้ได้",
+    forks: "ฟอร์ก",
+    preview: "ตัวอย่าง",
+    prop: "คุณสมบัติ",
+    selectTab: "เลือกแท็บ",
+    showMore: "แสดงเพิ่มเติม",
+    stars: "ดาว",
+    tab: "แท็บ {n}",
+    type: "ชนิด",
+    update: "อัปเดต",
   },
   feedback: {
     no: "ไม่",
@@ -87,8 +98,10 @@ export const th: UIStringsOverride = {
     assistantHint: "รับคำตอบทันทีจาก AI",
     button: "ค้นหา",
     devOnly: "การค้นหาพร้อมใช้งานในบิลด์โปรดักชัน",
+    docs: "เอกสาร",
     error: "เกิดข้อผิดพลาดบางอย่าง โปรดลองอีกครั้ง",
     label: "ค้นหาเอกสาร",
+    latest: "ล่าสุด",
     navigate: "นำทาง",
     noResults: "ไม่พบผลลัพธ์",
     open: "เปิด",

package/src/core/ui-packs/tr.ts

@@ -44,9 +44,20 @@ export const tr: UIStringsOverride = {
     title: "Değişiklik günlüğü",
   },
   content: {
+    code: "Kod",
     copyColor: "Rengi kopyala: {name} {value}",
     copyPrompt: "İstemi kopyala",
+    default: "Varsayılan",
     diagramError: "Bu diyagram görüntülenemedi.",
+    forks: "Çatallar",
+    preview: "Önizleme",
+    prop: "Özellik",
+    selectTab: "Sekme seç",
+    showMore: "Daha fazla göster",
+    stars: "Yıldızlar",
+    tab: "Sekme {n}",
+    type: "Tür",
+    update: "Güncelleme",
   },
   feedback: {
     no: "Hayır",
@@ -88,8 +99,10 @@ export const tr: UIStringsOverride = {
     assistantHint: "Yapay zekâdan anında yanıt alın",
     button: "Ara",
     devOnly: "Arama, üretim derlemesinde kullanılabilir.",
+    docs: "Belgeler",
     error: "Bir şeyler ters gitti. Lütfen tekrar deneyin.",
     label: "Belgelerde ara",
+    latest: "en son",
     navigate: "gezin",
     noResults: "Sonuç bulunamadı.",
     open: "aç",

package/src/core/ui-packs/uk.ts

@@ -44,9 +44,20 @@ export const uk: UIStringsOverride = {
     title: "Журнал змін",
   },
   content: {
+    code: "Код",
     copyColor: "Скопіювати колір {name} {value}",
     copyPrompt: "Скопіювати промпт",
+    default: "За замовчуванням",
     diagramError: "Не вдалося відобразити цю діаграму.",
+    forks: "Форки",
+    preview: "Попередній перегляд",
+    prop: "Властивість",
+    selectTab: "Вибрати вкладку",
+    showMore: "Показати більше",
+    stars: "Зірки",
+    tab: "Вкладка {n}",
+    type: "Тип",
+    update: "Оновлення",
   },
   feedback: {
     no: "Ні",
@@ -88,8 +99,10 @@ export const uk: UIStringsOverride = {
     assistantHint: "Отримайте миттєву відповідь від ШІ",
     button: "Пошук",
     devOnly: "Пошук доступний у production-збірці.",
+    docs: "Документація",
     error: "Щось пішло не так. Спробуйте ще раз.",
     label: "Пошук у документації",
+    latest: "остання",
     navigate: "навігація",
     noResults: "Нічого не знайдено.",
     open: "відкрити",

package/src/core/ui-packs/vi.ts

@@ -43,9 +43,20 @@ export const vi: UIStringsOverride = {
     title: "Nhật ký thay đổi",
   },
   content: {
+    code: "Mã",
     copyColor: "Sao chép màu {name} {value}",
     copyPrompt: "Sao chép prompt",
+    default: "Mặc định",
     diagramError: "Không thể hiển thị sơ đồ này.",
+    forks: "Fork",
+    preview: "Xem trước",
+    prop: "Thuộc tính",
+    selectTab: "Chọn tab",
+    showMore: "Hiển thị thêm",
+    stars: "Sao",
+    tab: "Tab {n}",
+    type: "Kiểu",
+    update: "Cập nhật",
   },
   feedback: {
     no: "Không",
@@ -87,8 +98,10 @@ export const vi: UIStringsOverride = {
     assistantHint: "Nhận câu trả lời tức thì từ AI",
     button: "Tìm kiếm",
     devOnly: "Tìm kiếm có sẵn trong bản dựng production.",
+    docs: "Tài liệu",
     error: "Đã xảy ra sự cố. Vui lòng thử lại.",
     label: "Tìm kiếm tài liệu",
+    latest: "mới nhất",
     navigate: "di chuyển",
     noResults: "Không tìm thấy kết quả.",
     open: "mở",

package/src/core/ui-packs/zh-tw.ts

@@ -43,9 +43,20 @@ export const zhTW: UIStringsOverride = {
     title: "更新日誌",
   },
   content: {
+    code: "程式碼",
     copyColor: "複製顏色 {name} {value}",
     copyPrompt: "複製提示詞",
+    default: "預設值",
     diagramError: "無法顯示此圖表。",
+    forks: "複刻",
+    preview: "預覽",
+    prop: "屬性",
+    selectTab: "選擇分頁",
+    showMore: "顯示更多",
+    stars: "星標",
+    tab: "分頁 {n}",
+    type: "型別",
+    update: "更新",
   },
   feedback: {
     no: "沒有幫助",
@@ -87,8 +98,10 @@ export const zhTW: UIStringsOverride = {
     assistantHint: "從 AI 即時取得解答",
     button: "搜尋",
     devOnly: "搜尋在正式版組建中可用。",
+    docs: "文件",
     error: "發生了一些問題，請再試一次。",
     label: "搜尋文件",
+    latest: "最新",
     navigate: "導覽",
     noResults: "找不到結果。",
     open: "開啟",

package/src/core/ui-packs/zh.ts

@@ -43,9 +43,20 @@ export const zh: UIStringsOverride = {
     title: "更新日志",
   },
   content: {
+    code: "代码",
     copyColor: "复制颜色 {name} {value}",
     copyPrompt: "复制提示词",
+    default: "默认值",
     diagramError: "无法渲染此图表。",
+    forks: "复刻",
+    preview: "预览",
+    prop: "属性",
+    selectTab: "选择标签页",
+    showMore: "显示更多",
+    stars: "星标",
+    tab: "标签页 {n}",
+    type: "类型",
+    update: "更新",
   },
   feedback: {
     no: "没有帮助",
@@ -87,8 +98,10 @@ export const zh: UIStringsOverride = {
     assistantHint: "从 AI 即时获取答案",
     button: "搜索",
     devOnly: "搜索在生产构建中可用。",
+    docs: "文档",
     error: "出了点问题，请重试。",
     label: "搜索文档",
+    latest: "最新",
     navigate: "导航",
     noResults: "未找到结果。",
     open: "打开",

package/src/core/version-cut.ts

@@ -65,6 +65,13 @@ const buildRouteRewrites = (
   const { basePath, i18n } = project.config;
   const { contentRoot } = project.context;
   const rewrites = new Map<string, string>();
+  // Under i18n, authors write links in the unprefixed form (`/guides/setup`)
+  // and rendering moves them into the reader's locale — a form no page is
+  // routed at when the default locale keeps its prefix
+  // (`hideDefaultLocalePrefix: false`). So it is mapped too, to the
+  // unprefixed snapshot route, which rendering localizes the same way. Page
+  // routes win where the two forms coincide.
+  const logical = new Map<string, string>();
   for (const page of project.graph.pages) {
     // `sourcePath` marks a page backed by a local file, which excludes
     // generated and remote pages; the content-root check below excludes local
@@ -81,11 +88,19 @@ const buildRouteRewrites = (
     ) {
       continue;
     }
-    const logical = versionizeRoute(page.versionKey, id);
+    const snapshot = versionizeRoute(page.versionKey, id);
     rewrites.set(
       stripBasePath(basePath, page.route),
-      i18n ? localizeRoute(logical, page.locale, i18n) : logical
+      i18n ? localizeRoute(snapshot, page.locale, i18n) : snapshot
     );
+    if (i18n) {
+      logical.set(page.versionKey, snapshot);
+    }
+  }
+  for (const [route, snapshot] of logical) {
+    if (!rewrites.has(route)) {
+      rewrites.set(route, snapshot);
+    }
   }
   return rewrites;
 };

package/src/core/versions.ts

@@ -150,9 +150,12 @@ export const versionsDiagnostics = (
   for (const page of pages) {
     // The version-looking folder is the first segment of the source-local ref
     // (e.g. `v1.0/guide.md`), not the namespaced id (`filesystem:v1.0/guide.md`).
-    const [first] = page.source.ref.split("/");
+    // Only a folder can be a snapshot: a root file like `v3-migration.md` has
+    // no further segments.
+    const [first, ...rest] = page.source.ref.split("/");
     if (
       first &&
+      rest.length > 0 &&
       !seen.has(first) &&
       VERSION_LIKE.test(first) &&
       !configured.has(first)

package/src/deploy/adapters/node.ts

@@ -7,8 +7,11 @@ export const NODE_ADAPTER_PACKAGE = "@astrojs/node";
 
 /**
  * Options for {@link node}: `output`, `site`, and `base`, plus any option of
- * `@astrojs/node` forwarded verbatim (`mode`, `host`, `port`, …). Blume
- * defaults `mode` to `"standalone"`; an option you pass wins.
+ * `@astrojs/node` forwarded verbatim (`mode`, `staticHeaders`, …). Blume
+ * defaults `mode` to `"standalone"`; an option you pass wins. `host` and
+ * `port` are forwarded too, but `@astrojs/node` replaces both with Astro's
+ * own server settings, so the standalone server listens on `localhost:4321`
+ * unless the `HOST` and `PORT` environment variables are set when it starts.
  */
 export type NodeOptions = DeployOptions;
 

package/src/deploy/adapters/registry.ts

@@ -7,6 +7,7 @@ import { netlify, netlifyAdapterSchema } from "./netlify.ts";
 import type { NetlifyAdapter } from "./netlify.ts";
 import { node, nodeAdapterSchema } from "./node.ts";
 import type { NodeAdapter } from "./node.ts";
+import { siteUrlSchema } from "./types.ts";
 import type { DeployOutput, StaticDeployment } from "./types.ts";
 import { vercel, vercelAdapterSchema } from "./vercel.ts";
 import type { VercelAdapter } from "./vercel.ts";
@@ -56,7 +57,7 @@ const staticDeploymentSchema = z.strictObject(
   {
     base: z.string().optional(),
     kind: z.literal("static").optional(),
-    site: z.url().optional(),
+    site: siteUrlSchema.optional(),
   },
   {
     error: (issue) => (issue.code === "unrecognized_keys" ? HINT : undefined),

package/src/deploy/adapters/types.ts

@@ -59,12 +59,24 @@ export interface StaticDeployment {
   site?: string;
 }
 
+/**
+ * `deployment.site`: an absolute http(s) URL, which always has a host. A bare
+ * `z.url()` takes any scheme, so `localhost:4321` (scheme `localhost:`),
+ * `mailto:`, and `javascript:` all passed and became the prefix of every
+ * sitemap entry and canonical link.
+ */
+export const siteUrlSchema = z.url({
+  error:
+    'Use an absolute http(s) URL with a host, like "https://docs.example.com" or "http://localhost:4321".',
+  protocol: /^https?$/u,
+});
+
 /** The named options' schema; every host adapter extends it with `z.json()` passthrough. */
 export const deployOptionsSchema = z
   .object({
     base: z.string().optional(),
     output: z.enum(["static", "server"]).optional(),
-    site: z.url().optional(),
+    site: siteUrlSchema.optional(),
   })
   .catchall(z.json());
 

package/src/deploy/artifacts.ts

@@ -4,6 +4,7 @@ import { mkdir, readFile, writeFile } from "node:fs/promises";
 import { dirname, join, resolve } from "pathe";
 
 import { buildAgentReadability } from "../ai/agent-readability.ts";
+import { advertisedConfig, servesMcp } from "../ai/agent-surface.ts";
 import {
   AI_CATALOG_PATH,
   ARD_MANIFEST_PATH,
@@ -15,6 +16,7 @@ import { buildLlmsFiles } from "../ai/llms.ts";
 import { markdownRoutePaths } from "../ai/markdown.ts";
 import {
   AGENT_SKILLS_DIR,
+  AGENT_SKILLS_INDEX_PATH,
   buildSkillsIndex,
   collectSkills,
 } from "../ai/skills.ts";
@@ -23,6 +25,7 @@ import {
   buildSignaturesDirectory,
   SIGNATURES_DIRECTORY_PATH,
 } from "../ai/web-bot-auth.ts";
+import { discoverPagesSync } from "../core/custom-pages.ts";
 import type { BlumeProject } from "../core/project-graph.ts";
 import type { ResolvedConfig } from "../core/schema.ts";
 import { buildSearchIndex } from "../search/build.ts";
@@ -367,9 +370,26 @@ export const publishBuildArtifacts = async (
   });
 
   // Collected once: llms.txt lists the skills the build publishes below.
+  const userSkillsIndex = existsSync(
+    join(distDir, AGENT_SKILLS_INDEX_PATH.slice(1))
+  );
   const skills = await collectConfiguredSkills(project, distDir, logger);
+  // The discovery documents advertise what this build serves: no MCP server
+  // when a page took its route, no skills index when nothing was published.
+  const advertised: BlumeProject = {
+    ...project,
+    config: advertisedConfig(project.config, {
+      mcp: servesMcp(
+        project,
+        project.context.pagesRoot
+          ? discoverPagesSync(project.context.pagesRoot)
+          : []
+      ),
+      skills: skills.length > 0 || userSkillsIndex,
+    }),
+  };
   if (project.config.agents.llmsTxt.enabled) {
-    await publishLlmsFiles(project, distDir, skills, logger);
+    await publishLlmsFiles(advertised, distDir, skills, logger);
   }
 
   const sitemapFiles = buildSitemapFiles(project);
@@ -388,7 +408,7 @@ export const publishBuildArtifacts = async (
     logger.info("Generated robots.txt");
   }
 
-  const agentReadability = buildAgentReadability(project);
+  const agentReadability = buildAgentReadability(advertised);
   if (
     agentReadability &&
     !existsSync(join(distDir, "agent-readability.json"))
@@ -401,9 +421,9 @@ export const publishBuildArtifacts = async (
     logger.info("Generated agent-readability.json");
   }
 
-  await emitWellKnownFiles(project.config, distDir, skills, logger);
+  await emitWellKnownFiles(advertised.config, distDir, skills, logger);
   await emitAgentSkills(project, distDir, skills, logger);
 
-  await emitRedirectFiles(project, distDir, logger);
-  await emitHeaderFiles(project, distDir, logger);
+  await emitRedirectFiles(advertised, distDir, logger);
+  await emitHeaderFiles(advertised, distDir, logger);
 };

package/src/deploy/cloudflare-negotiation.ts

@@ -39,8 +39,9 @@
  *
  * Cloudflare does not apply `_headers` to worker-first routes, so the wrapper
  * also re-stamps what the static layer would otherwise add on the routes it
- * takes over: the homepage agent-discovery `Link` header and the Markdown
- * `charset=utf-8` (see `deploy/headers.ts`). The raw `.md`/`.mdx` URLs are
+ * takes over: the homepage agent-discovery `Link` header, the Markdown
+ * `charset=utf-8`, and the sandbox on the SVGs a content source downloaded
+ * (see `deploy/headers.ts`). The raw `.md`/`.mdx` URLs are
  * exempted from worker-first routing with negative rules, keeping their
  * `_headers` treatment and their zero-Worker serving path.
  *
@@ -84,6 +85,7 @@ import {
   OPENAPI_PATH,
 } from "../ai/api/paths.ts";
 import { normalizePath } from "../core/base-path.ts";
+import { CONTENT_ASSETS_ROOT, SVG_ASSET_HEADERS } from "./headers.ts";
 import type { NotFoundVariants } from "./vercel-negotiation.ts";
 
 /** Filename of the generated wrapper Worker, next to the adapter's entry. */
@@ -314,8 +316,8 @@ export const buildNegotiationWorker = (
 // request is delegated to the Astro Worker untouched — except a missing
 // page, whose HTML 404 shell is swapped for the prerendered Markdown or JSON
 // 404 twin when the client prefers one. \`_headers\` does not apply to
-// worker-first routes, so the homepage Link header and the Markdown charset
-// are re-stamped here.
+// worker-first routes, so the homepage Link header, the Markdown charset, and
+// the sandbox on downloaded SVGs are re-stamped here.
 import server from ${JSON.stringify(options.mainSpecifier)};
 
 const ROUTES = new Set(${routes});
@@ -326,6 +328,16 @@ const HOME_LINK_HEADER = ${homeLinkHeader};
 const HOME_TOKENS = ${homeTokens};
 const REDIRECTS = ${redirects};
 const NOT_FOUND = ${notFound};
+const SVG_ASSET_HEADERS = ${JSON.stringify(SVG_ASSET_HEADERS)};
+
+// An SVG a content source downloaded: a document that could run script as the
+// docs site if opened directly, so it goes out sandboxed. Matched on the
+// decoded path, ignoring case — the file the assets binding serves.
+const isSvgAsset = (pathname) => {
+  const path = safeDecode(pathname).toLowerCase();
+  const prefix = (safeDecode(BASE_PREFIX) + "${CONTENT_ASSETS_ROOT}/").toLowerCase();
+  return path.startsWith(prefix) && path.endsWith(".svg");
+};
 
 // Configured redirects live in \`_redirects\`, which only the static layer
 // reads — a worker-first route never reaches it. Answering from this baked-in
@@ -526,6 +538,13 @@ export default {
         status: redirect[1],
       });
     }
+    if (isSvgAsset(url.pathname)) {
+      return withHeaders(await server.fetch(request, env, context), (headers) => {
+        for (const [name, value] of Object.entries(SVG_ASSET_HEADERS)) {
+          headers.set(name, value);
+        }
+      });
+    }
     if (request.method !== "GET" && request.method !== "HEAD") {
       return server.fetch(request, env, context);
     }

package/src/deploy/headers.ts

@@ -29,45 +29,44 @@ import type { ResolvedConfig } from "../core/schema.ts";
 
 /**
  * One rule per served extension. `.mdx` uses `text/markdown` to match the
- * runtime endpoint, which serves both variants as `text/markdown`. The raw
- * Markdown mirrors live under the page routes (which carry `basePath`), while
- * the `.txt` files (`llms.txt`, `llms-full.txt`) are written to the dist root
- * and served at the deployment base — so only the `.md`/`.mdx` rules take the
- * `basePath` layer.
+ * runtime endpoint, which serves both variants as `text/markdown`. Every rule
+ * sits at the deployment base, not under `basePath`: most Markdown mirrors
+ * live under the page routes, but the section home's mirror (`/docs.md`) sits
+ * beside `basePath`, and the synthesized `/index.md`, `/changelog.md`, and
+ * `/404.md` sit at the root, as do the `.txt` files (`llms.txt`,
+ * `llms-full.txt`).
  */
-const HEADER_RULES: readonly {
-  contentType: string;
-  ext: string;
-  underBasePath: boolean;
-}[] = [
-  {
-    contentType: "text/markdown; charset=utf-8",
-    ext: "md",
-    underBasePath: true,
-  },
-  {
-    contentType: "text/markdown; charset=utf-8",
-    ext: "mdx",
-    underBasePath: true,
-  },
-  {
-    contentType: "text/plain; charset=utf-8",
-    ext: "txt",
-    underBasePath: false,
-  },
+const HEADER_RULES: readonly { contentType: string; ext: string }[] = [
+  { contentType: "text/markdown; charset=utf-8", ext: "md" },
+  { contentType: "text/markdown; charset=utf-8", ext: "mdx" },
+  { contentType: "text/plain; charset=utf-8", ext: "txt" },
 ];
 
 /** Where the generated endpoint serves content-source images from. */
-const CONTENT_ASSETS_ROOT = "/blume-assets";
+export const CONTENT_ASSETS_ROOT = "/blume-assets";
 
 /**
  * The policy a content-source SVG is served with: an opaque origin with
  * scripts off, so an uploaded SVG that carries a `<script>` stays inert when
- * opened directly. The endpoint sends it from the server and dev runtimes;
- * {@link headerRules} carries it to static hosts.
+ * opened directly.
  */
 export const SVG_ASSET_POLICY = "sandbox";
 
+/**
+ * The headers a content-source SVG is served with: the sandbox policy, and no
+ * MIME sniffing. The endpoint sends them from the dev runtime; every host
+ * gets them for the built files — static hosts through {@link headerRules},
+ * server builds through each platform's own mechanism (`deploy/platforms`).
+ */
+export const SVG_ASSET_HEADERS = {
+  "Content-Security-Policy": SVG_ASSET_POLICY,
+  "X-Content-Type-Options": "nosniff",
+} satisfies Record<string, string>;
+
+/** The served glob of content-source SVGs, under the deployment base. */
+export const svgAssetPath = (config: ResolvedConfig): string =>
+  `${normalizeBasePath(config.deployment.options.base)}${CONTENT_ASSETS_ROOT}/*.svg`;
+
 /**
  * One static-host header rule: a served path (a `*` glob spanning path
  * segments, or an exact path) and the header it sets there.
@@ -80,11 +79,9 @@ export interface HeaderRule {
 
 /**
  * The header rules every static host should apply, in `_headers` glob syntax.
- * The glob carries the served prefix (`{deployment.base}{basePath}` for the
- * Markdown mirrors, `{deployment.base}` for the root `.txt` files) so the rules
- * still match once the site is mounted under a subpath (`/docs/*.md`); the
- * wildcard spans path segments, so a nested route like `/docs/ja/intro.md`
- * matches too.
+ * The glob carries the deployment base so the rules still match once the site
+ * is mounted under a subpath (`/docs/*.md`); the wildcard spans path
+ * segments, so a nested route like `/docs/ja/intro.md` matches too.
  *
  * When a homepage `Link` header is provided (see `ai/link-headers.ts`), an
  * exact-path rule for the root page advertises the agent-discovery resources —
@@ -95,16 +92,11 @@ export const headerRules = (
   homeLinkHeader?: string | null
 ): HeaderRule[] => {
   const deployBase = normalizeBasePath(config.deployment.options.base);
-  const rules: HeaderRule[] = HEADER_RULES.map((rule) => {
-    const prefix = rule.underBasePath
-      ? `${deployBase}${config.basePath}`
-      : deployBase;
-    return {
-      name: "Content-Type",
-      path: `${prefix}/*.${rule.ext}`,
-      value: rule.contentType,
-    };
-  });
+  const rules: HeaderRule[] = HEADER_RULES.map((rule) => ({
+    name: "Content-Type",
+    path: `${deployBase}/*.${rule.ext}`,
+    value: rule.contentType,
+  }));
   if (homeLinkHeader) {
     rules.push({ name: "Link", path: `${deployBase}/`, value: homeLinkHeader });
   }
@@ -134,9 +126,8 @@ export const headerRules = (
       value: "*",
     });
   }
-  // Published skills live at the deployment base, outside `basePath` — the
-  // `.md` charset rule above misses them whenever a basePath is set, and the
-  // RFC wants archives served as application/gzip explicitly.
+  // Published skills live at the deployment base, and the RFC wants their
+  // archives served as application/gzip explicitly.
   if (config.agents.skills) {
     rules.push(
       {
@@ -155,11 +146,9 @@ export const headerRules = (
   // are served from the docs origin, and an SVG opened directly is a document
   // that can run script. A sandbox policy keeps it inert; an `<img>` that
   // embeds it is unaffected.
-  rules.push({
-    name: "Content-Security-Policy",
-    path: `${deployBase}${CONTENT_ASSETS_ROOT}/*.svg`,
-    value: SVG_ASSET_POLICY,
-  });
+  for (const [name, value] of Object.entries(SVG_ASSET_HEADERS)) {
+    rules.push({ name, path: svgAssetPath(config), value });
+  }
   return rules;
 };
 
@@ -175,6 +164,33 @@ export const buildNetlifyHeaders = (
     .map((rule) => `${rule.path}\n  ${rule.name}: ${rule.value}`)
     .join("\n")}\n`;
 
+/** One entry of Netlify's Frameworks API config `headers` array. */
+export interface NetlifyConfigHeaders {
+  for: string;
+  values: Record<string, string>;
+}
+
+/**
+ * The {@link headerRules} as Netlify Frameworks API `headers` entries
+ * (`.netlify/v1/config.json`), one per path with every header it sets. A
+ * `netlify()` server build reads no `_headers` file, so it carries the same
+ * rules here, in the `for`/`values` form that follows `netlify.toml`'s
+ * `[[headers]]` and the same path syntax as `_headers`.
+ */
+export const buildNetlifyConfigHeaders = (
+  config: ResolvedConfig,
+  homeLinkHeader?: string | null
+): NetlifyConfigHeaders[] => {
+  const byPath = new Map<string, Record<string, string>>();
+  for (const rule of headerRules(config, homeLinkHeader)) {
+    byPath.set(rule.path, {
+      ...byPath.get(rule.path),
+      [rule.name]: rule.value,
+    });
+  }
+  return [...byPath].map(([path, values]) => ({ for: path, values }));
+};
+
 /** One entry of `vercel.json`'s `headers` array. */
 export interface VercelHeader {
   headers: { key: string; value: string }[];