blume 2.0.2 → 2.0.3

package/src/core/sources/notion.ts

@@ -15,14 +15,15 @@ import {
   pollingWatch,
   snapshotCache,
 } from "./cache.ts";
+import type { InlineRun } from "./lower.ts";
 import {
   codeFence,
   guardBlockStart,
   image,
+  linkParts,
   renderInline,
-  renderLink,
 } from "./lower.ts";
-import { slugifyPath } from "./normalize.ts";
+import { slugify, slugifyPath } from "./normalize.ts";
 import type {
   ContentSource,
   SourceContext,
@@ -160,26 +161,43 @@ interface NotionFrontmatter {
   [key: string]: boolean | string | { order: number } | undefined;
 }
 
+/** Neighboring rich-text runs that link to one `href` (or none), and it. */
+interface LinkedRuns {
+  href?: string;
+  runs: InlineRun[];
+}
+
 /**
- * Rich text as Markdown for an MDX body. Each run goes through the shared
+ * Rich text as Markdown for an MDX body. The runs go through the shared
  * lowering, so a literal `{`, `<`, `*`, or `[` typed in Notion renders as
- * itself instead of opening a JSX expression, a tag, or emphasis, and a code
- * run keeps its text verbatim inside a long-enough code span.
+ * itself instead of opening a JSX expression, a tag, or emphasis, a code run
+ * keeps its text verbatim inside a long-enough code span, neighbors share
+ * their marks' delimiters, and neighbors that link to one `href` share one
+ * link.
  */
-const richToMarkdown = (rich: NotionRichText[] = []): string =>
-  rich
-    .map(({ annotations = {}, href, plain_text: text }) =>
-      renderLink(
-        renderInline(text, {
-          bold: annotations.bold,
-          code: annotations.code,
-          italic: annotations.italic,
-          strike: annotations.strikethrough,
-        }),
-        href ?? undefined
-      )
-    )
-    .join("");
+const richToMarkdown = (rich: NotionRichText[] = []): string => {
+  const linked: LinkedRuns[] = [];
+  for (const { annotations = {}, href, plain_text: text } of rich) {
+    const run: InlineRun = {
+      marks: {
+        bold: annotations.bold,
+        code: annotations.code,
+        italic: annotations.italic,
+        strike: annotations.strikethrough,
+      },
+      text,
+    };
+    const last = linked.at(-1);
+    if (last && last.href === (href ?? undefined)) {
+      last.runs.push(run);
+    } else {
+      linked.push({ href: href ?? undefined, runs: [run] });
+    }
+  }
+  return renderInline(
+    linked.flatMap(({ href, runs }) => linkParts(runs, href))
+  );
+};
 
 const isBlockPayload = (
   value: NotionBlockPayload | boolean | string | undefined
@@ -307,10 +325,14 @@ const renderVideo = (data: NotionBlockPayload): string => {
   const title = caption ? ` title=${jsxString(richToPlain(data.caption))}` : "";
   // Everything else (a Notion upload, or a direct link to a media file) is a
   // real video file: `materializeAssets` rewrites the `src`, which matters most
-  // for uploads, whose Notion URLs are signed and expire.
+  // for uploads, whose Notion URLs are signed and expire. It finds the file by
+  // that quoted `src`, where MDX decodes no backslash escapes — a JSON
+  // string's `\\` and `\"` would corrupt the URL or end the attribute — so the
+  // URL goes in as written, with a double quote as the `%22` it means anyway.
+  // The embed's `url` takes the expression form, like every string prop here.
   const media = isYouTubeUrl(url)
-    ? `<YouTube${title} url=${JSON.stringify(url)} />`
-    : `<video controls src=${JSON.stringify(url)} />`;
+    ? `<YouTube${title} url=${jsxString(url)} />`
+    : `<video controls src="${url.replaceAll('"', "%22")}" />`;
   return caption
     ? `<Frame caption=${jsxString(caption.replaceAll(FRAME_ESCAPED, ""))}>\n${media}\n</Frame>`
     : media;
@@ -577,9 +599,14 @@ export const notionSource = (
     const slugProp = richToPlain(
       page.properties[props.slug ?? "Slug"]?.rich_text
     );
-    // Path-aware: a `guides/setup` slug keeps its `/` (per-segment slugging)
-    // instead of mashing into `guidessetup`.
-    const slug = slugifyPath(slugProp || title) || page.id;
+    // A Slug property is path-aware: `guides/setup` keeps its `/` (per-segment
+    // slugging) instead of mashing into `guidessetup`. A title is one name, so
+    // its slashes become hyphens: "CI/CD Setup" routes to `ci-cd-setup`, not
+    // to `cd-setup` inside an invented `ci` group.
+    const slug =
+      (slugProp
+        ? slugifyPath(slugProp)
+        : slugify(title.replaceAll("/", "-"))) || page.id;
     return { data, slug };
   };
 

package/src/core/sources/obsidian.ts

@@ -21,6 +21,7 @@ import {
   resolveEntryRoute,
   slugifyPath,
   strippedLineOffset,
+  unloadablePathDiagnostic,
 } from "./normalize.ts";
 import type {
   ContentSource,
@@ -587,10 +588,11 @@ const transformBody = (
  * `[#custom-id]` pin and the `setup-1` a later collision gets are honored
  * rather than re-slugged. When no heading holds anything the rewrite changes,
  * the raw body's headings are the staged body's; otherwise the body is lowered
- * once more so the headings are scanned exactly as they ship. A link inside a
- * heading is rewritten here before the other notes' anchors are known, so its
- * own anchor is left off; that only moves the manifest id of a heading that
- * itself holds a heading link, which the docs already flag as unaddressable.
+ * once more so the headings are scanned exactly as they ship. A heading link
+ * inside a heading is rewritten here before every note's anchors are known,
+ * so its href may still lack the anchor it ships with. That moves no id: a
+ * heading is slugged by its rendered text, where the link is its label alone,
+ * so the heading stays as addressable as any other.
  */
 const fillAnchors = (pair: IndexedPair, index: LinkIndex): void => {
   const raw = extractHeadings(pair.note.content);
@@ -958,7 +960,19 @@ export const obsidianSource = (
   const exclude = new Set([...BLUME_IGNORE_DIRS, ...(options.exclude ?? [])]);
 
   const load = async (): Promise<SourceLoadResult> => {
-    const files = await walkVault(vaultDir, vaultDir, exclude);
+    // A note is staged under its vault path, where Astro's content loader
+    // can't read a name holding `#` or `?`; such a note is reported and left
+    // out, and links to it degrade like links to any missing note.
+    const skipped: Diagnostic[] = [];
+    const files: string[] = [];
+    for (const rel of await walkVault(vaultDir, vaultDir, exclude)) {
+      const unloadable = unloadablePathDiagnostic(rel, join(vaultDir, rel));
+      if (unloadable) {
+        skipped.push(unloadable);
+      } else {
+        files.push(rel);
+      }
+    }
     const read = await Promise.all(
       files.map((rel) => readNote(vaultDir, rel, options))
     );
@@ -971,7 +985,10 @@ export const obsidianSource = (
       noteToEntry(pair, index, options, unresolved)
     );
     return {
-      diagnostics: unresolvedDiagnostics(options.name, unresolved),
+      diagnostics: [
+        ...skipped,
+        ...unresolvedDiagnostics(options.name, unresolved),
+      ],
       entries,
     };
   };

package/src/core/sources/portable-text.ts

@@ -4,11 +4,12 @@
  * user-supplied serializer or are skipped with a noted comment. Output is
  * Markdown text that flows through Blume's normal pipeline.
  */
+import type { InlineRun } from "./lower.ts";
 import {
   guardBlockStart,
   image,
+  linkParts,
   renderInline,
-  renderLink,
   unsupported,
   writesMdx,
 } from "./lower.ts";
@@ -73,38 +74,54 @@ const HEADING_STYLES = new Map([
   ["h6", "###### "],
 ]);
 
-/**
- * A span as Markdown for its marks, through the shared lowering every CMS
- * uses: prose is escaped, a code span outruns the backticks inside it, edge
- * whitespace stays outside emphasis, and a link def wraps last (so its label
- * keeps emphasis) only when its destination is safe to click.
- */
-const renderSpan = (
-  span: PortableTextSpan,
-  defs: Map<string, PortableTextMarkDef>
-): string => {
+/** A span's text and the marks Markdown has syntax for. */
+const spanRun = (span: PortableTextSpan): InlineRun => {
   const marks = span.marks ?? [];
-  const link = marks
-    .map((mark) => defs.get(mark))
-    .findLast((def) => def?._type === "link");
-  return renderLink(
-    renderInline(span.text ?? "", {
+  return {
+    marks: {
       bold: marks.includes("strong"),
       code: marks.includes("code"),
       italic: marks.includes("em"),
       strike: marks.includes("strike-through"),
-    }),
-    link?.href
-  );
+    },
+    text: span.text ?? "",
+  };
 };
 
-/** Render the inline children of a block to a single Markdown string. */
+/** Neighboring spans under one link def (or none), and that def. */
+interface LinkedSpans {
+  link?: PortableTextMarkDef;
+  runs: InlineRun[];
+}
+
+/**
+ * Render the inline children of a block to a single Markdown string, through
+ * the shared lowering every CMS uses: prose is escaped, a code span outruns
+ * the backticks inside it, edge whitespace stays outside emphasis, neighbors
+ * share their marks' delimiters, and neighbors under one link def share one
+ * link — wrapped last (so its label keeps emphasis), and only when its
+ * destination is safe to click.
+ */
 const renderChildren = (block: PortableTextBlock): string => {
   const defs = new Map(
     (block.markDefs ?? []).map((def) => [def._key, def] as const)
   );
+  const linked: LinkedSpans[] = [];
+  for (const span of block.children ?? []) {
+    const link = (span.marks ?? [])
+      .map((mark) => defs.get(mark))
+      .findLast((def) => def?._type === "link");
+    const last = linked.at(-1);
+    if (last && last.link === link) {
+      last.runs.push(spanRun(span));
+    } else {
+      linked.push({ link, runs: [spanRun(span)] });
+    }
+  }
   return guardBlockStart(
-    (block.children ?? []).map((span) => renderSpan(span, defs)).join("")
+    renderInline(
+      linked.flatMap(({ link, runs }) => linkParts(runs, link?.href))
+    )
   );
 };
 

package/src/core/sources/strapi-blocks.ts

@@ -5,6 +5,7 @@
  */
 import type { JsonObject, JsonValue } from "./json.ts";
 import { asNumber, asObject, asString, objectsIn } from "./json.ts";
+import type { InlinePart } from "./lower.ts";
 import {
   absoluteUrl,
   blockquote,
@@ -12,10 +13,10 @@ import {
   guardBlockStart,
   headingPrefix,
   image,
+  linkParts,
   listItem,
   markdownDocument,
   renderInline,
-  renderLink,
   unsupported,
 } from "./lower.ts";
 
@@ -28,34 +29,37 @@ const children = (node: JsonObject): JsonObject[] => objectsIn(node.children);
 
 const typeOf = (node: JsonObject): string => asString(node.type) ?? "";
 
-const renderInlines = (nodes: JsonObject[]): string =>
-  nodes
-    // oxlint-disable-next-line no-use-before-define -- mutual recursion: a link's label is itself inline content
-    .map((node) => renderInlineNode(node))
-    .join("");
+const inlineParts = (nodes: JsonObject[]): InlinePart[] =>
+  // oxlint-disable-next-line no-use-before-define -- mutual recursion: a link's label is itself inline content
+  nodes.flatMap((node) => inlineNodeParts(node));
 
-const renderInlineNode = (node: JsonObject): string => {
+const inlineNodeParts = (node: JsonObject): InlinePart[] => {
   switch (typeOf(node)) {
     case "text": {
-      return renderInline(asString(node.text) ?? "", {
-        bold: node.bold === true,
-        code: node.code === true,
-        italic: node.italic === true,
-        strike: node.strikethrough === true,
-      });
+      return [
+        {
+          marks: {
+            bold: node.bold === true,
+            code: node.code === true,
+            italic: node.italic === true,
+            strike: node.strikethrough === true,
+          },
+          text: asString(node.text) ?? "",
+        },
+      ];
     }
     case "link": {
-      return renderLink(renderInlines(children(node)), asString(node.url));
+      return linkParts(inlineParts(children(node)), asString(node.url));
     }
     default: {
-      return renderInlines(children(node));
+      return inlineParts(children(node));
     }
   }
 };
 
 /** A text block's inline nodes, joined and guarded as one block. */
 const blockText = (nodes: JsonObject[]): string =>
-  guardBlockStart(renderInlines(nodes));
+  guardBlockStart(renderInline(inlineParts(nodes)));
 
 const renderList = (node: JsonObject): string => {
   const ordered = asString(node.format) === "ordered";

package/src/core/sources/watch.ts

@@ -51,18 +51,26 @@ export const baselineScanIgnore = (): string[] =>
  */
 export const BLUME_WATCH_IGNORE_DIRS = BLUME_IGNORE_DIRS;
 
-/** Extract single-segment ignore dirs (`foo`) from `foo/**`-style excludes. */
+/**
+ * Extract root-anchored ignore dirs (`/foo`) from `foo/**`-style excludes. The
+ * scan's glob `foo/**` matches `foo` at the source root only, so the watcher
+ * skips that one directory: a nested `guides/foo/` is still content, and an
+ * edit there must still reload.
+ */
 export const excludeDirSegments = (patterns: readonly string[]): string[] =>
   patterns
     .map((pattern) => /^(?<dir>[^*/]+)\/\*\*$/u.exec(pattern)?.groups?.dir)
-    .filter((dir): dir is string => dir !== undefined);
+    .filter((dir): dir is string => dir !== undefined)
+    .map((dir) => `/${dir}`);
 
 /**
  * Build a recursive-watch listener that fires `onChange` for content changes but
- * ignores events whose path crosses an ignored directory segment — one in
- * `ignoreDirs`, or one `ignoreSegment` rejects, for a scan whose skip rule is
- * a shape (every dot-name) rather than a list. A missing `filename` — rare;
- * the platform couldn't name the changed path — falls through to `onChange`
+ * ignores events whose path crosses an ignored directory — a segment named in
+ * `ignoreDirs` at any depth, or one `ignoreSegment` rejects, for a scan whose
+ * skip rule is a shape (every dot-name) rather than a list. An entry written
+ * with a leading slash (`/drafts`, see {@link excludeDirSegments}) names a
+ * directory at the watched root only. A missing `filename` — rare; the
+ * platform couldn't name the changed path — falls through to `onChange`
  * rather than silently dropping a real edit. Exported for testing.
  */
 export const ignoringWatchListener = (
@@ -76,7 +84,12 @@ export const ignoringWatchListener = (
       filename !== null &&
       filename
         .split(/[/\\]/u)
-        .some((segment) => ignore.has(segment) || ignoreSegment(segment))
+        .some(
+          (segment, index) =>
+            ignore.has(segment) ||
+            (index === 0 && ignore.has(`/${segment}`)) ||
+            ignoreSegment(segment)
+        )
     ) {
       return;
     }

package/src/core/standard-schema.ts

@@ -50,11 +50,15 @@ export interface StandardSchema<Input = unknown, Output = Input> {
  * Whether a config-supplied value implements the `~standard` contract. Generic
  * so it can decode any input at the config boundary (`z.custom` hands it the
  * raw config value) while narrowing whatever type the caller holds.
+ *
+ * The contract is the `~standard` property, whatever carries it: Zod and
+ * Valibot schemas are objects, but an ArkType type is a callable function. The
+ * optional-chained probe reads the property off either, and off `null`,
+ * `undefined`, or a primitive it finds nothing.
  */
 export const isStandardSchema = <T>(value: T): value is T & StandardSchema =>
-  typeof value === "object" &&
-  value !== null &&
-  // SAFETY: the assertion only widens the checked object for property probing;
-  // the trailing typeof check is what verifies `~standard.validate` exists.
-  typeof (value as { "~standard"?: { validate?: unknown } })["~standard"]
-    ?.validate === "function";
+  // SAFETY: the assertion only widens the value for property probing; the
+  // typeof check is what verifies `~standard.validate` exists.
+  typeof (
+    value as { "~standard"?: { validate?: unknown } } | null | undefined
+  )?.["~standard"]?.validate === "function";

package/src/core/version-cut.ts

@@ -3,7 +3,7 @@ import { cp, readdir, readFile, rm } from "node:fs/promises";
 
 import { join, relative } from "pathe";
 
-import { stripBasePath } from "./base-path.ts";
+import { mountBasePath, stripBasePath } from "./base-path.ts";
 import { nextFenceState } from "./code-fences.ts";
 import type { FenceState } from "./code-fences.ts";
 import { writeTextAtomic } from "./fs-atomic.ts";
@@ -45,18 +45,22 @@ export class CutError extends Error {
 // matching so replacements can splice into the real line by index (the mask
 // preserves length). Mirrors the content-assets rewriter.
 const INLINE_CODE = /`[^`]*`/gu;
-// A markdown link/image target or an HTML href/src attribute whose value is
-// root-absolute. Named groups carry the prefix (kept) and target (rewritten).
-const ROOT_LINK = /(?<prefix>\]\(|href="|src=")(?<target>\/[^\s"')]*)/gu;
+// A root-absolute markdown link/image target, reference-style link definition
+// (`[setup]: /guides/setup`, up to three spaces in, never a `[^note]:`
+// footnote), or HTML href/src attribute in either quote style. Named groups
+// carry the prefix (kept) and target (rewritten).
+const ROOT_LINK =
+  /(?<prefix>\]\(|^ {0,3}\[(?!\^)[^\]]+\]:[ \t]*<?|(?:href|src)=["'])(?<target>\/[^\s"'<>)]*)/gu;
 
 /**
  * Build the link-rewrite table: every current-version route (basePath
- * stripped, since authors write root-absolute links as if mounted at root)
- * mapped to the same page's route inside the new snapshot. Only pages the
- * snapshot actually contains qualify — filesystem pages under the content
- * root. Spec-rendered references (`/api`, `/events`) and remote sources
- * aren't copied, so links to them keep pointing at the live pages instead of
- * a 404 inside the snapshot.
+ * stripped, since authors write root-absolute links as if mounted at root;
+ * a link that spells the base out is looked up without it, see
+ * `snapshotTarget`) mapped to the same page's route inside the new snapshot.
+ * Only pages the snapshot actually contains qualify — filesystem pages under
+ * the content root. Spec-rendered references (`/api`, `/events`) and remote
+ * sources aren't copied, so links to them keep pointing at the live pages
+ * instead of a 404 inside the snapshot.
  */
 const buildRouteRewrites = (
   project: BlumeProject,
@@ -105,8 +109,35 @@ const buildRouteRewrites = (
   return rewrites;
 };
 
+/**
+ * The snapshot link a root-absolute path rewrites to, or undefined when the
+ * snapshot has no copy of its page. A path written with the base path by hand
+ * (`/docs/guides/x` under `basePath: "/docs"`) names the same page as
+ * `/guides/x` — rendering leaves an already-based link alone (see
+ * `withBasePath`) — so it is looked up without the base and keeps it.
+ */
+const snapshotTarget = (
+  path: string,
+  rewrites: Map<string, string>,
+  basePath: string
+): string | undefined => {
+  const based =
+    basePath !== "" && (path === basePath || path.startsWith(`${basePath}/`));
+  if (!based) {
+    return rewrites.get(path);
+  }
+  const replacement = rewrites.get(stripBasePath(basePath, path));
+  return replacement === undefined
+    ? undefined
+    : mountBasePath(basePath, replacement);
+};
+
 /** Rewrite one line's root-absolute internal links via the rewrite table. */
-const rewriteLine = (line: string, rewrites: Map<string, string>): string => {
+const rewriteLine = (
+  line: string,
+  rewrites: Map<string, string>,
+  basePath: string
+): string => {
   const masked = line.replaceAll(INLINE_CODE, (span) =>
     " ".repeat(span.length)
   );
@@ -120,7 +151,7 @@ const rewriteLine = (line: string, rewrites: Map<string, string>): string => {
     const path = hash === -1 ? target : target.slice(0, hash);
     const suffix = hash === -1 ? "" : target.slice(hash);
     const bare = path !== "/" && path.endsWith("/") ? path.slice(0, -1) : path;
-    const replacement = rewrites.get(bare);
+    const replacement = snapshotTarget(bare, rewrites, basePath);
     if (replacement === undefined) {
       continue;
     }
@@ -142,10 +173,12 @@ export interface SnapshotRewrite {
  * Rewrite a copied page's root-absolute internal links to their snapshot
  * equivalents, skipping fenced and inline code. Relative links need no
  * rewriting — the whole tree copies together, so they stay self-contained.
+ * `basePath` is the site's, for links that spell it out by hand.
  */
 export const rewriteSnapshotLinks = (
   source: string,
-  rewrites: Map<string, string>
+  rewrites: Map<string, string>,
+  basePath = ""
 ): SnapshotRewrite => {
   let fence: FenceState = null;
   let count = 0;
@@ -156,7 +189,7 @@ export const rewriteSnapshotLinks = (
     if (inFence) {
       return line;
     }
-    const rewrittenLine = rewriteLine(line, rewrites);
+    const rewrittenLine = rewriteLine(line, rewrites, basePath);
     if (rewrittenLine !== line) {
       count += 1;
     }
@@ -416,7 +449,11 @@ export const cutVersion = async (
           return;
         }
         const source = await readFile(abs, "utf-8");
-        const { text, count } = rewriteSnapshotLinks(source, rewrites);
+        const { text, count } = rewriteSnapshotLinks(
+          source,
+          rewrites,
+          project.config.basePath
+        );
         if (count > 0) {
           await writeTextAtomic(abs, text);
           rewritten.push({ count, file: relative(dir, abs) });

package/src/deploy/artifacts.ts

@@ -25,6 +25,7 @@ import {
   buildSignaturesDirectory,
   SIGNATURES_DIRECTORY_PATH,
 } from "../ai/web-bot-auth.ts";
+import { normalizeBasePath } from "../core/base-path.ts";
 import { discoverPagesSync } from "../core/custom-pages.ts";
 import type { BlumeProject } from "../core/project-graph.ts";
 import type { ResolvedConfig } from "../core/schema.ts";
@@ -51,10 +52,12 @@ import { buildSitemapFiles, describeSitemapFiles } from "./sitemap.ts";
  * Written from the integration's `astro:build:done` hook — Astro's channel
  * for exactly this kind of post-build work — into the directory Astro
  * reports as the client output (`dist/`, or `dist/client` for a server
- * build). The Vercel adapter copies that directory into its Build Output
- * static tree in a later hook, so the artifacts ride along; every other
- * adapter serves it directly. Running inside the hook rather than after
- * `astro build` returns means an ejected project keeps producing them.
+ * build, or `dist/client/<base>/` on Cloudflare, whose `_headers` goes to
+ * the root the platform serves above it). The Vercel adapter copies that
+ * directory into its Build Output static tree in a later hook, so the
+ * artifacts ride along; every other adapter serves it directly. Running
+ * inside the hook rather than after `astro build` returns means an ejected
+ * project keeps producing them.
  *
  * Every file yields to one the user ships in `public/` (Astro copied it into
  * the output before this runs).
@@ -88,7 +91,7 @@ const emitRedirectFiles = async (
     return;
   }
   const platform = deployPlatform(config.deployment);
-  const redirects = platformRedirects(config);
+  const redirects = platformRedirects(project);
   const vercelHeaders = platform.redirectFiles.includes(VERCEL_JSON_FILE)
     ? buildVercelHeaders(
         config,
@@ -127,6 +130,24 @@ const emitRedirectFiles = async (
   logger.info(`Emitted redirect files for ${redirects.length} redirect(s)`);
 };
 
+/**
+ * The root of the static assets the platform serves, where it reads
+ * `_headers`: `distDir` itself, except on a server build whose adapter moved
+ * the client output under `deployment.base` (`@astrojs/cloudflare` hands
+ * `astro:build:done` `dist/client/<base>/` but serves `dist/client`). A file
+ * left in `distDir` there would never be read, and would be served publicly
+ * at `<base>/_headers`.
+ */
+const assetsRoot = (config: ResolvedConfig, distDir: string): string => {
+  const base = normalizeBasePath(config.deployment.options.base);
+  const nested =
+    config.deployment.options.output === "server" &&
+    deployPlatform(config.deployment).serverClientUnderBase;
+  // One `..` per base segment climbs back out of `dist/client/<base>/`.
+  const depth = base.split("/").length - 1;
+  return nested && base ? join(distDir, "../".repeat(depth)) : distDir;
+};
+
 /**
  * Emit a `_headers` file so Netlify / Cloudflare serve the raw AI-ready
  * endpoints (`*.md`, `*.mdx`, `*.txt`) with an explicit `charset=utf-8`. Without
@@ -179,7 +200,7 @@ export const emitHeaderFiles = async (
   // An adapter may have written its own rules here already (Cloudflare adds an
   // immutable Cache-Control for /_astro/*). Keep them and append ours: both
   // sets are wanted, and `_headers` has no merge semantics beyond order.
-  const target = join(distDir, "_headers");
+  const target = join(assetsRoot(config, distDir), "_headers");
   const existing = existsSync(target) ? await readFile(target, "utf-8") : "";
   await writeFile(
     target,

package/src/deploy/cloudflare-negotiation.ts

@@ -84,7 +84,7 @@ import {
   API_PAGES_PATH,
   OPENAPI_PATH,
 } from "../ai/api/paths.ts";
-import { normalizePath } from "../core/base-path.ts";
+import { normalizeBasePath, normalizePath } from "../core/base-path.ts";
 import { CONTENT_ASSETS_ROOT, SVG_ASSET_HEADERS } from "./headers.ts";
 import type { NotFoundVariants } from "./vercel-negotiation.ts";
 
@@ -132,14 +132,6 @@ const STATIC_EXEMPTIONS = [
   API_NAVIGATION_PATH,
 ];
 
-/**
- * The deployment base as a rule/URL prefix: trailing slash stripped, empty
- * for a root deploy — the same normalization the dev middleware applies in
- * `astro/markdown-negotiation.ts`.
- */
-const basePrefix = (base?: string): string =>
-  base && base !== "/" ? base.replace(/\/$/u, "") : "";
-
 /** A value as `JSON.parse` produces it (the wrangler config's value space). */
 type JsonValue =
   | string
@@ -180,7 +172,7 @@ const ruleBody = (rule: string): string =>
  * status (see the module comment).
  */
 export const buildRunWorkerFirstRules = (base?: string): string[] => {
-  const prefix = encodeURI(basePrefix(base));
+  const prefix = encodeURI(normalizeBasePath(base));
   const exemptions = STATIC_EXEMPTIONS.map((path) => `!${prefix}${path}`);
   return prefix
     ? [prefix, `${prefix}/*`, ...exemptions]
@@ -282,7 +274,7 @@ export const buildNegotiationWorker = (
   const routes = JSON.stringify(options.routePaths);
   const pageJson = JSON.stringify(options.pageJsonPaths ?? []);
   const binding = JSON.stringify(options.assetsBinding);
-  const prefix = JSON.stringify(encodeURI(basePrefix(options.base)));
+  const prefix = JSON.stringify(encodeURI(normalizeBasePath(options.base)));
   const homeLinkHeader = JSON.stringify(options.homeLinkHeader ?? null);
   const homeTokens = JSON.stringify(
     options.homeTokens === undefined ? null : String(options.homeTokens)
@@ -680,7 +672,7 @@ export const injectWorkerNegotiation = (
   // The content-route guard compares against redirect `from`s, which carry the
   // full `{deployment.base}{basePath}` stack; the routes carry only
   // `basePath`, so the deployment base is applied here.
-  const deployPrefix = basePrefix(options.base);
+  const deployPrefix = normalizeBasePath(options.base);
   const guardRoutes = new Set(
     contentRoutePaths.map((route) =>
       normalizePath(