blume 2.0.1 → 2.0.3

package/src/deploy/cloudflare-negotiation.ts

@@ -39,8 +39,9 @@
  *
  * Cloudflare does not apply `_headers` to worker-first routes, so the wrapper
  * also re-stamps what the static layer would otherwise add on the routes it
- * takes over: the homepage agent-discovery `Link` header and the Markdown
- * `charset=utf-8` (see `deploy/headers.ts`). The raw `.md`/`.mdx` URLs are
+ * takes over: the homepage agent-discovery `Link` header, the Markdown
+ * `charset=utf-8`, and the sandbox on the SVGs a content source downloaded
+ * (see `deploy/headers.ts`). The raw `.md`/`.mdx` URLs are
  * exempted from worker-first routing with negative rules, keeping their
  * `_headers` treatment and their zero-Worker serving path.
  *
@@ -83,7 +84,8 @@ import {
   API_PAGES_PATH,
   OPENAPI_PATH,
 } from "../ai/api/paths.ts";
-import { normalizePath } from "../core/base-path.ts";
+import { normalizeBasePath, normalizePath } from "../core/base-path.ts";
+import { CONTENT_ASSETS_ROOT, SVG_ASSET_HEADERS } from "./headers.ts";
 import type { NotFoundVariants } from "./vercel-negotiation.ts";
 
 /** Filename of the generated wrapper Worker, next to the adapter's entry. */
@@ -130,14 +132,6 @@ const STATIC_EXEMPTIONS = [
   API_NAVIGATION_PATH,
 ];
 
-/**
- * The deployment base as a rule/URL prefix: trailing slash stripped, empty
- * for a root deploy — the same normalization the dev middleware applies in
- * `astro/markdown-negotiation.ts`.
- */
-const basePrefix = (base?: string): string =>
-  base && base !== "/" ? base.replace(/\/$/u, "") : "";
-
 /** A value as `JSON.parse` produces it (the wrangler config's value space). */
 type JsonValue =
   | string
@@ -178,7 +172,7 @@ const ruleBody = (rule: string): string =>
  * status (see the module comment).
  */
 export const buildRunWorkerFirstRules = (base?: string): string[] => {
-  const prefix = encodeURI(basePrefix(base));
+  const prefix = encodeURI(normalizeBasePath(base));
   const exemptions = STATIC_EXEMPTIONS.map((path) => `!${prefix}${path}`);
   return prefix
     ? [prefix, `${prefix}/*`, ...exemptions]
@@ -280,7 +274,7 @@ export const buildNegotiationWorker = (
   const routes = JSON.stringify(options.routePaths);
   const pageJson = JSON.stringify(options.pageJsonPaths ?? []);
   const binding = JSON.stringify(options.assetsBinding);
-  const prefix = JSON.stringify(encodeURI(basePrefix(options.base)));
+  const prefix = JSON.stringify(encodeURI(normalizeBasePath(options.base)));
   const homeLinkHeader = JSON.stringify(options.homeLinkHeader ?? null);
   const homeTokens = JSON.stringify(
     options.homeTokens === undefined ? null : String(options.homeTokens)
@@ -314,8 +308,8 @@ export const buildNegotiationWorker = (
 // request is delegated to the Astro Worker untouched — except a missing
 // page, whose HTML 404 shell is swapped for the prerendered Markdown or JSON
 // 404 twin when the client prefers one. \`_headers\` does not apply to
-// worker-first routes, so the homepage Link header and the Markdown charset
-// are re-stamped here.
+// worker-first routes, so the homepage Link header, the Markdown charset, and
+// the sandbox on downloaded SVGs are re-stamped here.
 import server from ${JSON.stringify(options.mainSpecifier)};
 
 const ROUTES = new Set(${routes});
@@ -326,6 +320,16 @@ const HOME_LINK_HEADER = ${homeLinkHeader};
 const HOME_TOKENS = ${homeTokens};
 const REDIRECTS = ${redirects};
 const NOT_FOUND = ${notFound};
+const SVG_ASSET_HEADERS = ${JSON.stringify(SVG_ASSET_HEADERS)};
+
+// An SVG a content source downloaded: a document that could run script as the
+// docs site if opened directly, so it goes out sandboxed. Matched on the
+// decoded path, ignoring case — the file the assets binding serves.
+const isSvgAsset = (pathname) => {
+  const path = safeDecode(pathname).toLowerCase();
+  const prefix = (safeDecode(BASE_PREFIX) + "${CONTENT_ASSETS_ROOT}/").toLowerCase();
+  return path.startsWith(prefix) && path.endsWith(".svg");
+};
 
 // Configured redirects live in \`_redirects\`, which only the static layer
 // reads — a worker-first route never reaches it. Answering from this baked-in
@@ -526,6 +530,13 @@ export default {
         status: redirect[1],
       });
     }
+    if (isSvgAsset(url.pathname)) {
+      return withHeaders(await server.fetch(request, env, context), (headers) => {
+        for (const [name, value] of Object.entries(SVG_ASSET_HEADERS)) {
+          headers.set(name, value);
+        }
+      });
+    }
     if (request.method !== "GET" && request.method !== "HEAD") {
       return server.fetch(request, env, context);
     }
@@ -661,7 +672,7 @@ export const injectWorkerNegotiation = (
   // The content-route guard compares against redirect `from`s, which carry the
   // full `{deployment.base}{basePath}` stack; the routes carry only
   // `basePath`, so the deployment base is applied here.
-  const deployPrefix = basePrefix(options.base);
+  const deployPrefix = normalizeBasePath(options.base);
   const guardRoutes = new Set(
     contentRoutePaths.map((route) =>
       normalizePath(

package/src/deploy/headers.ts

@@ -29,45 +29,44 @@ import type { ResolvedConfig } from "../core/schema.ts";
 
 /**
  * One rule per served extension. `.mdx` uses `text/markdown` to match the
- * runtime endpoint, which serves both variants as `text/markdown`. The raw
- * Markdown mirrors live under the page routes (which carry `basePath`), while
- * the `.txt` files (`llms.txt`, `llms-full.txt`) are written to the dist root
- * and served at the deployment base — so only the `.md`/`.mdx` rules take the
- * `basePath` layer.
+ * runtime endpoint, which serves both variants as `text/markdown`. Every rule
+ * sits at the deployment base, not under `basePath`: most Markdown mirrors
+ * live under the page routes, but the section home's mirror (`/docs.md`) sits
+ * beside `basePath`, and the synthesized `/index.md`, `/changelog.md`, and
+ * `/404.md` sit at the root, as do the `.txt` files (`llms.txt`,
+ * `llms-full.txt`).
  */
-const HEADER_RULES: readonly {
-  contentType: string;
-  ext: string;
-  underBasePath: boolean;
-}[] = [
-  {
-    contentType: "text/markdown; charset=utf-8",
-    ext: "md",
-    underBasePath: true,
-  },
-  {
-    contentType: "text/markdown; charset=utf-8",
-    ext: "mdx",
-    underBasePath: true,
-  },
-  {
-    contentType: "text/plain; charset=utf-8",
-    ext: "txt",
-    underBasePath: false,
-  },
+const HEADER_RULES: readonly { contentType: string; ext: string }[] = [
+  { contentType: "text/markdown; charset=utf-8", ext: "md" },
+  { contentType: "text/markdown; charset=utf-8", ext: "mdx" },
+  { contentType: "text/plain; charset=utf-8", ext: "txt" },
 ];
 
 /** Where the generated endpoint serves content-source images from. */
-const CONTENT_ASSETS_ROOT = "/blume-assets";
+export const CONTENT_ASSETS_ROOT = "/blume-assets";
 
 /**
  * The policy a content-source SVG is served with: an opaque origin with
  * scripts off, so an uploaded SVG that carries a `<script>` stays inert when
- * opened directly. The endpoint sends it from the server and dev runtimes;
- * {@link headerRules} carries it to static hosts.
+ * opened directly.
  */
 export const SVG_ASSET_POLICY = "sandbox";
 
+/**
+ * The headers a content-source SVG is served with: the sandbox policy, and no
+ * MIME sniffing. The endpoint sends them from the dev runtime; every host
+ * gets them for the built files — static hosts through {@link headerRules},
+ * server builds through each platform's own mechanism (`deploy/platforms`).
+ */
+export const SVG_ASSET_HEADERS = {
+  "Content-Security-Policy": SVG_ASSET_POLICY,
+  "X-Content-Type-Options": "nosniff",
+} satisfies Record<string, string>;
+
+/** The served glob of content-source SVGs, under the deployment base. */
+export const svgAssetPath = (config: ResolvedConfig): string =>
+  `${normalizeBasePath(config.deployment.options.base)}${CONTENT_ASSETS_ROOT}/*.svg`;
+
 /**
  * One static-host header rule: a served path (a `*` glob spanning path
  * segments, or an exact path) and the header it sets there.
@@ -80,11 +79,9 @@ export interface HeaderRule {
 
 /**
  * The header rules every static host should apply, in `_headers` glob syntax.
- * The glob carries the served prefix (`{deployment.base}{basePath}` for the
- * Markdown mirrors, `{deployment.base}` for the root `.txt` files) so the rules
- * still match once the site is mounted under a subpath (`/docs/*.md`); the
- * wildcard spans path segments, so a nested route like `/docs/ja/intro.md`
- * matches too.
+ * The glob carries the deployment base so the rules still match once the site
+ * is mounted under a subpath (`/docs/*.md`); the wildcard spans path
+ * segments, so a nested route like `/docs/ja/intro.md` matches too.
  *
  * When a homepage `Link` header is provided (see `ai/link-headers.ts`), an
  * exact-path rule for the root page advertises the agent-discovery resources —
@@ -95,16 +92,11 @@ export const headerRules = (
   homeLinkHeader?: string | null
 ): HeaderRule[] => {
   const deployBase = normalizeBasePath(config.deployment.options.base);
-  const rules: HeaderRule[] = HEADER_RULES.map((rule) => {
-    const prefix = rule.underBasePath
-      ? `${deployBase}${config.basePath}`
-      : deployBase;
-    return {
-      name: "Content-Type",
-      path: `${prefix}/*.${rule.ext}`,
-      value: rule.contentType,
-    };
-  });
+  const rules: HeaderRule[] = HEADER_RULES.map((rule) => ({
+    name: "Content-Type",
+    path: `${deployBase}/*.${rule.ext}`,
+    value: rule.contentType,
+  }));
   if (homeLinkHeader) {
     rules.push({ name: "Link", path: `${deployBase}/`, value: homeLinkHeader });
   }
@@ -134,9 +126,8 @@ export const headerRules = (
       value: "*",
     });
   }
-  // Published skills live at the deployment base, outside `basePath` — the
-  // `.md` charset rule above misses them whenever a basePath is set, and the
-  // RFC wants archives served as application/gzip explicitly.
+  // Published skills live at the deployment base, and the RFC wants their
+  // archives served as application/gzip explicitly.
   if (config.agents.skills) {
     rules.push(
       {
@@ -155,11 +146,9 @@ export const headerRules = (
   // are served from the docs origin, and an SVG opened directly is a document
   // that can run script. A sandbox policy keeps it inert; an `<img>` that
   // embeds it is unaffected.
-  rules.push({
-    name: "Content-Security-Policy",
-    path: `${deployBase}${CONTENT_ASSETS_ROOT}/*.svg`,
-    value: SVG_ASSET_POLICY,
-  });
+  for (const [name, value] of Object.entries(SVG_ASSET_HEADERS)) {
+    rules.push({ name, path: svgAssetPath(config), value });
+  }
   return rules;
 };
 
@@ -175,6 +164,33 @@ export const buildNetlifyHeaders = (
     .map((rule) => `${rule.path}\n  ${rule.name}: ${rule.value}`)
     .join("\n")}\n`;
 
+/** One entry of Netlify's Frameworks API config `headers` array. */
+export interface NetlifyConfigHeaders {
+  for: string;
+  values: Record<string, string>;
+}
+
+/**
+ * The {@link headerRules} as Netlify Frameworks API `headers` entries
+ * (`.netlify/v1/config.json`), one per path with every header it sets. A
+ * `netlify()` server build reads no `_headers` file, so it carries the same
+ * rules here, in the `for`/`values` form that follows `netlify.toml`'s
+ * `[[headers]]` and the same path syntax as `_headers`.
+ */
+export const buildNetlifyConfigHeaders = (
+  config: ResolvedConfig,
+  homeLinkHeader?: string | null
+): NetlifyConfigHeaders[] => {
+  const byPath = new Map<string, Record<string, string>>();
+  for (const rule of headerRules(config, homeLinkHeader)) {
+    byPath.set(rule.path, {
+      ...byPath.get(rule.path),
+      [rule.name]: rule.value,
+    });
+  }
+  return [...byPath].map(([path, values]) => ({ for: path, values }));
+};
+
 /** One entry of `vercel.json`'s `headers` array. */
 export interface VercelHeader {
   headers: { key: string; value: string }[];
@@ -184,6 +200,13 @@ export interface VercelHeader {
 /** The characters `path-to-regexp` would read as syntax in a literal path. */
 const SOURCE_SYNTAX = /[\\(){}?+:]/gu;
 
+/**
+ * A literal path as `path-to-regexp` source text — what a `vercel.json`
+ * `source` is — with each syntax character escaped, so it matches only itself.
+ */
+export const escapeVercelSource = (path: string): string =>
+  path.replaceAll(SOURCE_SYNTAX, String.raw`\$&`);
+
 /**
  * A `_headers` path as a `vercel.json` `source`, which `path-to-regexp` reads:
  * the literal parts are escaped, and a `*` glob becomes the `(.*)` group that
@@ -193,10 +216,7 @@ const SOURCE_SYNTAX = /[\\(){}?+:]/gu;
 const vercelSource = (path: string): string => {
   const trimmed =
     path.length > 1 && path.endsWith("/") ? path.slice(0, -1) : path;
-  return trimmed
-    .split("*")
-    .map((part) => part.replaceAll(SOURCE_SYNTAX, String.raw`\$&`))
-    .join("(.*)");
+  return trimmed.split("*").map(escapeVercelSource).join("(.*)");
 };
 
 /**

package/src/deploy/node-headers.ts

@@ -13,12 +13,13 @@ import {
   SIGNATURES_DIRECTORY_PATH,
   SIGNATURES_DIRECTORY_TYPE,
 } from "../ai/web-bot-auth.ts";
-import { normalizeBasePath } from "../core/base-path.ts";
+import { normalizeBasePath, normalizePath } from "../core/base-path.ts";
 import type { BlumeProject } from "../core/project-graph.ts";
 import type { ResolvedConfig } from "../core/schema.ts";
-import { SVG_ASSET_POLICY } from "./headers.ts";
+import { SVG_ASSET_HEADERS, svgAssetPath } from "./headers.ts";
 import { distDir } from "./platforms/paths.ts";
 import type { BuildLog } from "./platforms/types.ts";
+import { platformRedirects } from "./redirects.ts";
 
 /**
  * The response headers the Node standalone server can't set itself. Its static
@@ -29,6 +30,12 @@ import type { BuildLog } from "./platforms/types.ts";
  * (`deploy/headers.ts`) that a Node server has no file to read from. The Markdown
  * and text charsets need no rule here: `send` already adds `charset=UTF-8` to
  * `text/*` types.
+ *
+ * The same wrapper answers the configured redirects. Astro's own handler
+ * honors a redirect's configured status only when its destination resolves
+ * to a discrete route, and Blume serves every page from `[...slug]`, so a
+ * `302` or `307` would go out as a `301` or `308` — permanent redirects that
+ * browsers cache.
  */
 
 /** The headers one exact served path (deployment base included) gets. */
@@ -93,35 +100,130 @@ const patternRules = (
     });
 
 /**
- * The entry that replaces Astro's: it stamps the rules' headers on the
- * response, then hands the request to Astro's handler. `send` leaves a
- * Content-Type that is already set alone, so the registered media type wins.
+ * The configured redirects the wrapper answers, keyed by served path (the
+ * trailing slash trimmed), each to its `Location` and exact status.
+ */
+export type NodeRedirects = Record<string, [string, number]>;
+
+/**
+ * The configured redirects, based the way the host matches them (see
+ * `platformRedirects`) and keyed for the wrapper's lookup, the `Location`
+ * percent-encoded as Astro sends it. A redirect at a content route's own path
+ * is left out: the prerendered page owns that URL, and the static handler
+ * serves it before Astro's redirect ever could.
+ */
+export const nodeRedirects = (project: BlumeProject): NodeRedirects => {
+  const { config } = project;
+  if (config.redirects.length === 0) {
+    return {};
+  }
+  const base = normalizeBasePath(config.deployment.options.base);
+  const pages = new Set(
+    project.manifest.routes.map((route) =>
+      normalizePath(`${base}${route.path}`)
+    )
+  );
+  return Object.fromEntries(
+    platformRedirects(project)
+      .filter((redirect) => !pages.has(normalizePath(redirect.from)))
+      .map((redirect) => [
+        normalizePath(redirect.from),
+        [encodeURI(redirect.to), redirect.status],
+      ])
+  );
+};
+
+/** What the wrapper needs beyond the header rules. */
+export interface NodeEntryOptions {
+  /** `deployment.base`, normalized (`""` at the root). */
+  base?: string;
+  /** The configured redirects, from {@link nodeRedirects}. */
+  redirects?: NodeRedirects;
+}
+
+/**
+ * The entry that replaces Astro's: it answers a configured redirect with its
+ * exact status, and otherwise stamps the rules' headers on the response and
+ * hands the request to Astro's handler. `send` leaves a Content-Type that is
+ * already set alone, so the registered media type wins.
+ *
+ * A rule matches the file the static handler will serve, not the raw URL:
+ * Astro strips the base when it leads the path and serves the rest from the
+ * client directory either way, and `send` decodes and normalizes the path —
+ * so `/docs/blume-assets/a.sv%67`, `/blume-assets/a.svg`, and
+ * `/docs//x/../blume-assets/a.svg` are all the same SVG. The comparison
+ * ignores case, as a case-insensitive disk and `send`'s MIME lookup do.
  *
  * It keeps Astro's contract — the `handler`, `options`, and `startServer`
  * exports `astro preview` and a middleware-mode host import — and its
  * autostart: Astro's entry is imported with autostart off (the env var is read
  * when that module evaluates, so the import has to be dynamic), and the
- * wrapper starts the server itself with its listener in front of Astro's.
+ * wrapper starts the server itself, taking over its request listener so a
+ * redirect is answered before Astro sees the request.
  */
-export const nodeEntryWrapper = (rules: readonly NodeHeaderRule[]): string =>
+export const nodeEntryWrapper = (
+  rules: readonly NodeHeaderRule[],
+  options: NodeEntryOptions = {}
+): string =>
   `${WRAPPER_MARKER}
 // Written by \`blume build\`: Astro's server entry is ./${NODE_ASTRO_ENTRY_FILE}.
-// This wrapper sets the media types and CORS headers of the .well-known
-// discovery files, which the standalone server's static handler can't, then
-// hands every request to Astro.
+// This wrapper answers the configured redirects with their exact status and
+// sets the headers the standalone server's static handler can't (the media
+// types and CORS headers of the .well-known discovery files, the sandbox on
+// downloaded SVGs), then hands every other request to Astro.
+import { posix } from "node:path";
+
+const BASE = ${JSON.stringify(options.base ?? "")};
 const RULES = new Map(${JSON.stringify(exactRules(rules))});
 const PATTERNS = ${JSON.stringify(patternRules(rules))};
+const REDIRECTS = ${JSON.stringify(options.redirects ?? {})};
+const safeDecode = (path) => {
+  try {
+    return decodeURIComponent(path);
+  } catch {
+    return path;
+  }
+};
+const urlPath = (req) => (req.url ?? "").split("#")[0].split("?")[0];
+// The file the static handler serves for a request, spelled with the base.
+const servedPath = (req) => {
+  const path = posix.normalize("/" + safeDecode(urlPath(req)));
+  const rest =
+    BASE && (path === BASE || path.startsWith(BASE + "/"))
+      ? path.slice(BASE.length)
+      : path;
+  return BASE + (rest || "/");
+};
 const applyHeaders = (req, res) => {
-  const path = (req.url ?? "").split("?")[0];
+  const path = servedPath(req);
+  const lower = path.toLowerCase();
   const headers =
     RULES.get(path) ??
-    PATTERNS.find(([prefix, suffix]) => path.startsWith(prefix) && path.endsWith(suffix))?.[2];
+    PATTERNS.find(
+      ([prefix, suffix]) =>
+        lower.startsWith(prefix.toLowerCase()) &&
+        lower.endsWith(suffix.toLowerCase())
+    )?.[2];
   if (headers) {
     for (const [name, value] of Object.entries(headers)) {
       res.setHeader(name, value);
     }
   }
 };
+// Answer a configured redirect with its exact status; Astro's handler would
+// send a 301 (a 308 for other methods) whatever the configured one.
+const answerRedirect = (req, res) => {
+  const path = urlPath(req);
+  const trimmed = path !== "/" && path.endsWith("/") ? path.slice(0, -1) : path;
+  const key = safeDecode(trimmed);
+  if (!Object.hasOwn(REDIRECTS, key)) {
+    return false;
+  }
+  const [location, status] = REDIRECTS[key];
+  res.writeHead(status, { location });
+  res.end();
+  return true;
+};
 const previous = process.env.ASTRO_NODE_AUTOSTART;
 process.env.ASTRO_NODE_AUTOSTART = "disabled";
 const astro = await import("./${NODE_ASTRO_ENTRY_FILE}");
@@ -132,17 +234,30 @@ if (previous === undefined) {
 }
 export const { options } = astro;
 export const handler = (req, res, ...rest) => {
+  if (answerRedirect(req, res)) {
+    return;
+  }
   applyHeaders(req, res);
   return astro.handler(req, res, ...rest);
 };
 export const startServer = () => {
   const started = astro.startServer();
-  // Stamp the headers only where the adapter exposes its HTTP server as
-  // expected; a different shape serves the files without them rather than
-  // failing to start.
+  // Take over the adapter's request listener only where it exposes its HTTP
+  // server as expected; a different shape serves without the headers and
+  // redirect statuses rather than failing to start.
   const httpServer = started?.server?.server;
-  if (typeof httpServer?.prependListener === "function") {
-    httpServer.prependListener("request", applyHeaders);
+  if (typeof httpServer?.listeners === "function") {
+    const astroListeners = httpServer.listeners("request");
+    httpServer.removeAllListeners("request");
+    httpServer.on("request", (req, res) => {
+      if (answerRedirect(req, res)) {
+        return;
+      }
+      applyHeaders(req, res);
+      for (const listener of astroListeners) {
+        listener.call(httpServer, req, res);
+      }
+    });
   }
   return started;
 };
@@ -152,9 +267,9 @@ if (options.mode === "standalone" && previous !== "disabled") {
 `;
 
 /**
- * Put the header wrapper in front of a Node server build's entry. A build
- * with no rule (no API catalog, AI catalog, MCP server, signatures directory,
- * or downloaded content assets) leaves Astro's entry alone.
+ * Put the wrapper in front of a Node server build's entry. A build with no
+ * rule (no API catalog, AI catalog, MCP server, signatures directory, or
+ * downloaded content assets) and no redirect leaves Astro's entry alone.
  */
 export const wrapNodeEntry = async (
   project: BlumeProject,
@@ -169,20 +284,21 @@ export const wrapNodeEntry = async (
     ...(existsSync(assetsDir)
       ? [
           {
-            headers: { "Content-Security-Policy": SVG_ASSET_POLICY },
-            path: `${normalizeBasePath(project.config.deployment.options.base)}/blume-assets/*.svg`,
+            headers: { ...SVG_ASSET_HEADERS },
+            path: svgAssetPath(project.config),
           },
         ]
       : []),
   ];
-  if (rules.length === 0) {
+  const redirects = nodeRedirects(project);
+  if (rules.length === 0 && Object.keys(redirects).length === 0) {
     return;
   }
   const serverDir = join(distDir(project.context), "server");
   const entry = join(serverDir, NODE_ENTRY_FILE);
   if (!existsSync(entry)) {
     log.warn(
-      `Could not find the Node server entry at ${entry}, so the .well-known discovery files are served without their media types and CORS headers.`
+      `Could not find the Node server entry at ${entry}, so the server runs without the headers and redirect statuses Blume sets there.`
     );
     return;
   }
@@ -191,8 +307,13 @@ export const wrapNodeEntry = async (
     return;
   }
   await rename(entry, join(serverDir, NODE_ASTRO_ENTRY_FILE));
-  await writeFile(entry, nodeEntryWrapper(rules), "utf-8");
-  log.success(
-    "Wired the .well-known discovery headers into the Node server entry"
+  await writeFile(
+    entry,
+    nodeEntryWrapper(rules, {
+      base: normalizeBasePath(project.config.deployment.options.base),
+      redirects,
+    }),
+    "utf-8"
   );
+  log.success("Wired headers and redirects into the Node server entry");
 };

package/src/deploy/platforms/cloudflare.ts

@@ -11,6 +11,7 @@ import {
   markdownRoutePaths,
   markdownTokenCount,
 } from "../../ai/markdown.ts";
+import { normalizeBasePath } from "../../core/base-path.ts";
 import type { BlumeProject } from "../../core/project-graph.ts";
 import type { ProjectContext } from "../../core/types.ts";
 import { CLOUDFLARE_ADAPTER_PACKAGE } from "../adapters/cloudflare.ts";
@@ -90,8 +91,13 @@ export const emitCloudflareNegotiation = async (
   const home = rawMarkdown["/"];
   // The 404 twins the wrapper may substitute for the HTML shell; only wired
   // when the build actually emitted them (a project that owns `/404` gets
-  // neither), like the Vercel routing config.
-  const staticDir = clientDir(context);
+  // neither), like the Vercel routing config. The adapter writes the
+  // prerendered files under the deployment base (`dist/client/<base>/`),
+  // where the wrapper fetches them from.
+  const staticDir = join(
+    clientDir(context),
+    normalizeBasePath(config.deployment.options.base)
+  );
   const injected = injectWorkerNegotiation(
     await readFile(wranglerPath, "utf-8"),
     {
@@ -119,7 +125,7 @@ export const emitCloudflareNegotiation = async (
       // based the same way the platform files are — it answers any the
       // worker-first rules claim, where `_redirects` is never consulted and
       // Astro would default their status.
-      redirects: platformRedirects(config),
+      redirects: platformRedirects(project),
       routePaths,
     }
   );
@@ -305,8 +311,12 @@ export const cloudflarePlatform: DeployPlatform = {
   },
   kind: "cloudflare",
   negotiatesMarkdown: true,
+  previewDeploy: null,
   readsHeaderFiles: { server: true, static: true },
   redirectFiles: [REDIRECTS_FILE],
+  // The adapter points `build.client` at `dist/client/<base>/` for a server
+  // build, and hoists its own `_headers`/`_redirects` back up to `dist/client`.
+  serverClientUnderBase: true,
   serverOutputDir: distDir,
   serverStaticDir: clientDir,
 };