blume 2.0.3 → 2.1.1

package/src/deploy/adapters/node.ts

@@ -1,3 +1,5 @@
+import { z } from "zod";
+
 import { adapterDescriptorSchema } from "../../core/adapter.ts";
 import type { DeployAdapter, DeployOptions } from "./types.ts";
 import { deployOptionsSchema, serverRuntimeDeps } from "./types.ts";
@@ -6,18 +8,54 @@ import { deployOptionsSchema, serverRuntimeDeps } from "./types.ts";
 export const NODE_ADAPTER_PACKAGE = "@astrojs/node";
 
 /**
- * Options for {@link node}: `output`, `site`, and `base`, plus any option of
- * `@astrojs/node` forwarded verbatim (`mode`, `staticHeaders`, …). Blume
- * defaults `mode` to `"standalone"`; an option you pass wins. `host` and
- * `port` are forwarded too, but `@astrojs/node` replaces both with Astro's
- * own server settings, so the standalone server listens on `localhost:4321`
- * unless the `HOST` and `PORT` environment variables are set when it starts.
+ * A host the server trusts forwarded headers for, in Astro's
+ * `security.allowedDomains` shape: each field set must match.
  */
-export type NodeOptions = DeployOptions;
+// oxlint-disable-next-line typescript/consistent-type-definitions -- interface loses the implicit index signature a deploy option's JsonValue needs
+export type NodeAllowedDomain = {
+  /** The host, like `docs.example.com`; `*.example.com` matches subdomains. */
+  hostname?: string;
+  /** The port, as a string. */
+  port?: string;
+  /** The scheme, like `https`. */
+  protocol?: string;
+};
 
-export type NodeAdapter = DeployAdapter<"node">;
+/**
+ * Options for {@link node}: `output`, `site`, `base`, and `allowedDomains`,
+ * plus any option of `@astrojs/node` forwarded verbatim (`mode`,
+ * `staticHeaders`, …). Blume defaults `mode` to `"standalone"`; an option you
+ * pass wins. `host` and `port` are forwarded too, but `@astrojs/node`
+ * replaces both with Astro's own server settings, so the standalone server
+ * listens on `localhost:4321` unless the `HOST` and `PORT` environment
+ * variables are set when it starts.
+ */
+export type NodeOptions = DeployOptions & {
+  /**
+   * The hosts a reverse proxy in front of the server answers for, set as
+   * Astro's `security.allowedDomains`. A request whose `Host` (or
+   * `X-Forwarded-Host`) matches one is trusted to name the reader in
+   * `X-Forwarded-For`, which the rate limit counts by; otherwise every
+   * reader counts as the proxy's address. Only list them when a proxy sets
+   * that header on every request, since a reader could otherwise send their
+   * own.
+   */
+  allowedDomains?: NodeAllowedDomain[];
+};
 
-export const nodeOptionsSchema = deployOptionsSchema;
+export type NodeAdapter = DeployAdapter<"node", NodeOptions>;
+
+export const nodeOptionsSchema = deployOptionsSchema.extend({
+  allowedDomains: z
+    .array(
+      z.strictObject({
+        hostname: z.string().min(1).optional(),
+        port: z.string().min(1).optional(),
+        protocol: z.string().min(1).optional(),
+      })
+    )
+    .optional(),
+});
 
 export const nodeAdapterSchema = adapterDescriptorSchema(
   "node",

package/src/deploy/adapters/types.ts

@@ -84,13 +84,17 @@ const NAMED_OPTIONS = new Set(["base", "output", "site"]);
 
 /**
  * The options Blume does not name — what reaches the `@astrojs/*` adapter's
- * constructor verbatim.
+ * constructor verbatim. `configOptions` are the ones a host adapter names
+ * itself, for the Astro config rather than the constructor.
  */
 export const deployPassthrough = (
-  options: DeployOptions
+  options: DeployOptions,
+  configOptions: readonly string[] = []
 ): Record<string, JsonValue> =>
   Object.fromEntries(
-    Object.entries(options).filter(([key]) => !NAMED_OPTIONS.has(key))
+    Object.entries(options).filter(
+      ([key]) => !(NAMED_OPTIONS.has(key) || configOptions.includes(key))
+    )
   );
 
 /**

package/src/deploy/artifacts.ts

@@ -14,6 +14,11 @@ import { API_CATALOG_PATH, buildApiCatalog } from "../ai/api-catalog.ts";
 import { buildHomeLinkHeader } from "../ai/link-headers.ts";
 import { buildLlmsFiles } from "../ai/llms.ts";
 import { markdownRoutePaths } from "../ai/markdown.ts";
+import {
+  buildSiteSkill,
+  SKILL_MD_PATH,
+  siteSkillName,
+} from "../ai/site-skill.ts";
 import {
   AGENT_SKILLS_DIR,
   AGENT_SKILLS_INDEX_PATH,
@@ -29,6 +34,7 @@ import { normalizeBasePath } from "../core/base-path.ts";
 import { discoverPagesSync } from "../core/custom-pages.ts";
 import type { BlumeProject } from "../core/project-graph.ts";
 import type { ResolvedConfig } from "../core/schema.ts";
+import { buildNarration } from "../narration/build.ts";
 import { buildSearchIndex } from "../search/build.ts";
 import { syncSearchProvider } from "../search/sync/index.ts";
 import { readsHeaderFiles } from "./adapter-output.ts";
@@ -212,7 +218,8 @@ export const emitHeaderFiles = async (
 
 /**
  * Collect the Agent Skills `agents.skills` publishes, once per build, so both the
- * skills surface and llms.txt (which lists them) read the same set. Empty
+ * skills surface and llms.txt (which lists them) read the same set (the
+ * generated site skill joins them in {@link publishedSkills}). Empty
  * when the feature is off, the directory is missing, nothing in it is
  * publishable (each with a warning), or a user-shipped
  * `public/.well-known/agent-skills/index.json` already owns the surface.
@@ -248,6 +255,57 @@ const collectConfiguredSkills = async (
   return skills;
 };
 
+/**
+ * Every skill the build publishes: the `agents.skills` ones, plus the
+ * generated site skill unless one of those shares its name (the hand-written
+ * one wins) or a user-shipped index owns the surface.
+ */
+const publishedSkills = async (
+  project: BlumeProject,
+  distDir: string,
+  surface: { mcp: boolean; userIndex: boolean },
+  logger: ArtifactLogger
+): Promise<SkillArtifact[]> => {
+  const configured = await collectConfiguredSkills(project, distDir, logger);
+  // The skill lists the MCP server only when the build serves it.
+  const site = surface.userIndex
+    ? null
+    : buildSiteSkill({
+        ...project,
+        config: advertisedConfig(project.config, {
+          mcp: surface.mcp,
+          skills: true,
+        }),
+      });
+  return site && !configured.some((skill) => skill.name === site.name)
+    ? [site, ...configured]
+    : configured;
+};
+
+/**
+ * Serve the site skill at `/skill.md` too, the path agents try first: the
+ * generated one, or a same-named hand-written skill that is a lone
+ * `SKILL.md` (an archive's relative references need its other files). A
+ * `public/skill.md` wins.
+ */
+const emitSkillMd = async (
+  project: BlumeProject,
+  distDir: string,
+  skills: readonly SkillArtifact[],
+  logger: ArtifactLogger
+): Promise<void> => {
+  const target = join(distDir, SKILL_MD_PATH.slice(1));
+  const name = siteSkillName(project);
+  const skill = skills.find(
+    (candidate) => candidate.name === name && candidate.type === "skill-md"
+  );
+  if (!(project.config.agents.skillMd && skill) || existsSync(target)) {
+    return;
+  }
+  await writeFile(target, skill.content);
+  logger.info(`Generated ${SKILL_MD_PATH.slice(1)} (the "${name}" skill)`);
+};
+
 /**
  * Publish the collected Agent Skills: copy each skill artifact under
  * `.well-known/agent-skills/` and emit the discovery index. A user-shipped
@@ -382,8 +440,13 @@ export const publishBuildArtifacts = async (
     logger.info(`Indexed ${indexed} page(s) for search`);
   }
 
+  // Generated narration reads the built pages, so it runs once they exist.
+  // Nothing happens without `narration.provider`.
+  await buildNarration(project, distDir, logger);
+
   // Upload the index to a hosted provider (Algolia, Orama Cloud, Typesense).
-  // Skipped with a warning when its admin key isn't configured.
+  // Skipped with a warning when its admin key isn't configured; with the key
+  // set, a failed sync fails the build.
   await syncSearchProvider(project, {
     start: logger.info.bind(logger),
     success: logger.info.bind(logger),
@@ -394,18 +457,24 @@ export const publishBuildArtifacts = async (
   const userSkillsIndex = existsSync(
     join(distDir, AGENT_SKILLS_INDEX_PATH.slice(1))
   );
-  const skills = await collectConfiguredSkills(project, distDir, logger);
+  const mcp = servesMcp(
+    project,
+    project.context.pagesRoot
+      ? discoverPagesSync(project.context.pagesRoot)
+      : []
+  );
+  const skills = await publishedSkills(
+    project,
+    distDir,
+    { mcp, userIndex: userSkillsIndex },
+    logger
+  );
   // The discovery documents advertise what this build serves: no MCP server
   // when a page took its route, no skills index when nothing was published.
   const advertised: BlumeProject = {
     ...project,
     config: advertisedConfig(project.config, {
-      mcp: servesMcp(
-        project,
-        project.context.pagesRoot
-          ? discoverPagesSync(project.context.pagesRoot)
-          : []
-      ),
+      mcp,
       skills: skills.length > 0 || userSkillsIndex,
     }),
   };
@@ -444,6 +513,7 @@ export const publishBuildArtifacts = async (
 
   await emitWellKnownFiles(advertised.config, distDir, skills, logger);
   await emitAgentSkills(project, distDir, skills, logger);
+  await emitSkillMd(project, distDir, skills, logger);
 
   await emitRedirectFiles(advertised, distDir, logger);
   await emitHeaderFiles(advertised, distDir, logger);

package/src/deploy/cloudflare-negotiation.ts

@@ -85,6 +85,7 @@ import {
   OPENAPI_PATH,
 } from "../ai/api/paths.ts";
 import { normalizeBasePath, normalizePath } from "../core/base-path.ts";
+import { compileRedirects, isPatternPath } from "../core/redirect-patterns.ts";
 import { CONTENT_ASSETS_ROOT, SVG_ASSET_HEADERS } from "./headers.ts";
 import type { NotFoundVariants } from "./vercel-negotiation.ts";
 
@@ -289,12 +290,18 @@ export const buildNegotiationWorker = (
   // header, which cannot carry non-ASCII.
   const redirects = JSON.stringify(
     Object.fromEntries(
-      (options.redirects ?? []).map((redirect) => [
-        normalizePath(redirect.from),
-        [encodeURI(redirect.to), redirect.status],
-      ])
+      (options.redirects ?? [])
+        .filter((redirect) => !isPatternPath(redirect.from))
+        .map((redirect) => [
+          normalizePath(redirect.from),
+          [encodeURI(redirect.to), redirect.status],
+        ])
     )
   );
+  // Patterns (`/beta/:slug*`) are tried in order after the exact paths.
+  const patternRedirects = JSON.stringify(
+    compileRedirects(options.redirects ?? [])
+  );
   return `// Generated by Blume. Do not edit; this file is recreated on each build.
 //
 // Request-time \`Accept: text/markdown\` negotiation for a Cloudflare server
@@ -319,6 +326,9 @@ const ASSETS_BINDING = ${binding};
 const HOME_LINK_HEADER = ${homeLinkHeader};
 const HOME_TOKENS = ${homeTokens};
 const REDIRECTS = ${redirects};
+const PATTERN_REDIRECTS = ${patternRedirects}.map(
+  ([source, location, status]) => [new RegExp(source, "u"), location, status]
+);
 const NOT_FOUND = ${notFound};
 const SVG_ASSET_HEADERS = ${JSON.stringify(SVG_ASSET_HEADERS)};
 
@@ -335,11 +345,31 @@ const isSvgAsset = (pathname) => {
 // reads — a worker-first route never reaches it. Answering from this baked-in
 // copy keeps the exact configured status; delegating instead would let Astro's
 // SSR handler default a GET to a permanent 301.
+// An exact path is looked up first, then each pattern is tried in order, its
+// Location template filled with the captures, encoded so a capture can't grow
+// a query or fragment.
 const redirectFor = (pathname) => {
   const trimmed =
     pathname !== "/" && pathname.endsWith("/") ? pathname.slice(0, -1) : pathname;
   const path = safeDecode(trimmed);
-  return Object.hasOwn(REDIRECTS, path) ? REDIRECTS[path] : null;
+  if (Object.hasOwn(REDIRECTS, path)) {
+    return REDIRECTS[path];
+  }
+  const decoded = safeDecode(pathname);
+  for (const [pattern, location, status] of PATTERN_REDIRECTS) {
+    const match = pattern.exec(decoded);
+    if (match) {
+      return [
+        location.replace(/\\$(\\d+)/gu, (_reference, index) =>
+          encodeURI(match[Number(index)] ?? "")
+            .replaceAll("?", "%3F")
+            .replaceAll("#", "%23")
+        ),
+        status,
+      ];
+    }
+  }
+  return null;
 };
 
 // The request path with the deployment base removed: the whole path on a

package/src/deploy/headers.ts

@@ -4,6 +4,7 @@ import {
   API_CATALOG_TYPE,
   hasApiCatalog,
 } from "../ai/api-catalog.ts";
+import { servesSkillsIndex } from "../ai/skills.ts";
 import {
   SIGNATURES_DIRECTORY_PATH,
   SIGNATURES_DIRECTORY_TYPE,
@@ -128,7 +129,7 @@ export const headerRules = (
   }
   // Published skills live at the deployment base, and the RFC wants their
   // archives served as application/gzip explicitly.
-  if (config.agents.skills) {
+  if (servesSkillsIndex(config)) {
     rules.push(
       {
         name: "Content-Type",

package/src/deploy/node-headers.ts

@@ -15,6 +15,8 @@ import {
 } from "../ai/web-bot-auth.ts";
 import { normalizeBasePath, normalizePath } from "../core/base-path.ts";
 import type { BlumeProject } from "../core/project-graph.ts";
+import { compileRedirects, isPatternPath } from "../core/redirect-patterns.ts";
+import type { CompiledRedirect } from "../core/redirect-patterns.ts";
 import type { ResolvedConfig } from "../core/schema.ts";
 import { SVG_ASSET_HEADERS, svgAssetPath } from "./headers.ts";
 import { distDir } from "./platforms/paths.ts";
@@ -106,11 +108,12 @@ const patternRules = (
 export type NodeRedirects = Record<string, [string, number]>;
 
 /**
- * The configured redirects, based the way the host matches them (see
+ * The configured exact redirects, based the way the host matches them (see
  * `platformRedirects`) and keyed for the wrapper's lookup, the `Location`
  * percent-encoded as Astro sends it. A redirect at a content route's own path
  * is left out: the prerendered page owns that URL, and the static handler
- * serves it before Astro's redirect ever could.
+ * serves it before Astro's redirect ever could. Patterns are compiled apart
+ * ({@link nodePatternRedirects}).
  */
 export const nodeRedirects = (project: BlumeProject): NodeRedirects => {
   const { config } = project;
@@ -125,7 +128,13 @@ export const nodeRedirects = (project: BlumeProject): NodeRedirects => {
   );
   return Object.fromEntries(
     platformRedirects(project)
-      .filter((redirect) => !pages.has(normalizePath(redirect.from)))
+      .filter(
+        (redirect) =>
+          !(
+            isPatternPath(redirect.from) ||
+            pages.has(normalizePath(redirect.from))
+          )
+      )
       .map((redirect) => [
         normalizePath(redirect.from),
         [encodeURI(redirect.to), redirect.status],
@@ -133,12 +142,27 @@ export const nodeRedirects = (project: BlumeProject): NodeRedirects => {
   );
 };
 
+/**
+ * The configured pattern redirects (`/beta/:slug*`), based the way the host
+ * matches them and compiled for the wrapper, which tries them in order after
+ * the exact ones. None can match a page: the scan rejects a pattern that
+ * does (`BLUME_REDIRECT_MATCHES_PAGE`).
+ */
+export const nodePatternRedirects = (
+  project: BlumeProject
+): CompiledRedirect[] =>
+  project.config.redirects.length === 0
+    ? []
+    : compileRedirects(platformRedirects(project));
+
 /** What the wrapper needs beyond the header rules. */
 export interface NodeEntryOptions {
   /** `deployment.base`, normalized (`""` at the root). */
   base?: string;
   /** The configured redirects, from {@link nodeRedirects}. */
   redirects?: NodeRedirects;
+  /** The configured pattern redirects, from {@link nodePatternRedirects}. */
+  patternRedirects?: CompiledRedirect[];
 }
 
 /**
@@ -177,6 +201,9 @@ const BASE = ${JSON.stringify(options.base ?? "")};
 const RULES = new Map(${JSON.stringify(exactRules(rules))});
 const PATTERNS = ${JSON.stringify(patternRules(rules))};
 const REDIRECTS = ${JSON.stringify(options.redirects ?? {})};
+const PATTERN_REDIRECTS = ${JSON.stringify(options.patternRedirects ?? [])}.map(
+  ([source, location, status]) => [new RegExp(source, "u"), location, status]
+);
 const safeDecode = (path) => {
   try {
     return decodeURIComponent(path);
@@ -210,16 +237,37 @@ const applyHeaders = (req, res) => {
     }
   }
 };
+// A pattern redirect's Location: its template, each $n filled with that
+// capture, encoded so it can't grow a query or fragment.
+const fillLocation = (location, match) =>
+  location.replace(/\\$(\\d+)/gu, (_reference, index) =>
+    encodeURI(match[Number(index)] ?? "")
+      .replaceAll("?", "%3F")
+      .replaceAll("#", "%23")
+  );
+// The configured redirect for a decoded path: an exact one, else the first
+// pattern that matches it.
+const redirectFor = (path) => {
+  const trimmed = path !== "/" && path.endsWith("/") ? path.slice(0, -1) : path;
+  if (Object.hasOwn(REDIRECTS, trimmed)) {
+    return REDIRECTS[trimmed];
+  }
+  for (const [pattern, location, status] of PATTERN_REDIRECTS) {
+    const match = pattern.exec(path);
+    if (match) {
+      return [fillLocation(location, match), status];
+    }
+  }
+  return null;
+};
 // Answer a configured redirect with its exact status; Astro's handler would
 // send a 301 (a 308 for other methods) whatever the configured one.
 const answerRedirect = (req, res) => {
-  const path = urlPath(req);
-  const trimmed = path !== "/" && path.endsWith("/") ? path.slice(0, -1) : path;
-  const key = safeDecode(trimmed);
-  if (!Object.hasOwn(REDIRECTS, key)) {
+  const redirect = redirectFor(safeDecode(urlPath(req)));
+  if (redirect === null) {
     return false;
   }
-  const [location, status] = REDIRECTS[key];
+  const [location, status] = redirect;
   res.writeHead(status, { location });
   res.end();
   return true;
@@ -291,7 +339,12 @@ export const wrapNodeEntry = async (
       : []),
   ];
   const redirects = nodeRedirects(project);
-  if (rules.length === 0 && Object.keys(redirects).length === 0) {
+  const patternRedirects = nodePatternRedirects(project);
+  if (
+    rules.length === 0 &&
+    Object.keys(redirects).length === 0 &&
+    patternRedirects.length === 0
+  ) {
     return;
   }
   const serverDir = join(distDir(project.context), "server");
@@ -311,6 +364,7 @@ export const wrapNodeEntry = async (
     entry,
     nodeEntryWrapper(rules, {
       base: normalizeBasePath(project.config.deployment.options.base),
+      patternRedirects,
       redirects,
     }),
     "utf-8"

package/src/deploy/platforms/cloudflare.ts

@@ -14,6 +14,7 @@ import {
 import { normalizeBasePath } from "../../core/base-path.ts";
 import type { BlumeProject } from "../../core/project-graph.ts";
 import type { ProjectContext } from "../../core/types.ts";
+import { withRateLimitBinding } from "../../ratelimit/wrangler.ts";
 import { CLOUDFLARE_ADAPTER_PACKAGE } from "../adapters/cloudflare.ts";
 import {
   injectWorkerNegotiation,
@@ -274,17 +275,51 @@ export const nameCloudflareWorker = async (
 };
 
 /**
- * Cloudflare Workers and Pages. A server build emits the Worker into
- * `dist/server` and serves `dist/client` through the ASSETS binding, which
- * honors `_headers` from that directory exactly as Pages does — so the file
- * applies to both output modes here. Without a configured driver the adapter
- * force-enables KV-backed sessions and declares a `SESSION` binding that
- * `wrangler deploy` then demands a namespace for, even though Blume never
- * reads `Astro.session`; `session: false` opts the project out.
+ * Declare the Workers rate limiting binding `rateLimit: cloudflare()` counts
+ * with in the built Worker's config, which `wrangler deploy` reads.
+ */
+export const bindCloudflareRateLimit = async (
+  project: BlumeProject,
+  log: BuildLog
+): Promise<void> => {
+  const { rateLimit } = project.config;
+  if (rateLimit?.kind !== "cloudflare") {
+    return;
+  }
+  const wranglerPath = join(
+    distDir(project.context),
+    "server",
+    "wrangler.json"
+  );
+  const bound = existsSync(wranglerPath)
+    ? withRateLimitBinding(await readFile(wranglerPath, "utf-8"), rateLimit)
+    : null;
+  if (bound === null) {
+    log.warn(
+      "Could not declare the rate limiting binding in dist/server/wrangler.json — the routes count in memory instead."
+    );
+    return;
+  }
+  await writeFile(wranglerPath, bound, "utf-8");
+  log.success("Declared the Workers rate limiting binding");
+};
+
+/**
+ * Cloudflare. A server build targets Workers only (`@astrojs/cloudflare`
+ * dropped Pages in v13): it emits the Worker into `dist/server` and serves
+ * `dist/client` through the ASSETS binding, which honors `_headers` from that
+ * directory exactly as Pages does — so the file applies to both output modes
+ * here. A static build never loads the adapter; its `dist/` deploys to Pages,
+ * whose build environment `env` detects, or to Workers static assets (Workers
+ * Builds exposes no site URL to detect). Without a configured driver the
+ * adapter force-enables KV-backed sessions and declares a `SESSION` binding
+ * that `wrangler deploy` then demands a namespace for, even though Blume
+ * never reads `Astro.session`; `session: false` opts the project out.
  */
 export const cloudflarePlatform: DeployPlatform = {
   astro: {
-    config: { session: false },
+    config: () => ({ session: false }),
+    configOptions: [],
     options: adapterOptions,
     package: CLOUDFLARE_ADAPTER_PACKAGE,
   },
@@ -298,6 +333,7 @@ export const cloudflarePlatform: DeployPlatform = {
     if (!isolated) {
       await nameCloudflareWorker(project, log);
       await emitCloudflareNegotiation(project, log);
+      await bindCloudflareRateLimit(project, log);
       await emitCloudflareDeployConfig(project.context);
     }
     return true;
@@ -318,5 +354,5 @@ export const cloudflarePlatform: DeployPlatform = {
   // build, and hoists its own `_headers`/`_redirects` back up to `dist/client`.
   serverClientUnderBase: true,
   serverOutputDir: distDir,
-  serverStaticDir: clientDir,
+  serverStaticDir: (context, base) => join(clientDir(context), base),
 };

package/src/deploy/platforms/netlify.ts

@@ -9,7 +9,11 @@ import type { BlumeProject } from "../../core/project-graph.ts";
 import { NETLIFY_ADAPTER_PACKAGE } from "../adapters/netlify.ts";
 import { buildNetlifyConfigHeaders } from "../headers.ts";
 import type { NetlifyConfigHeaders } from "../headers.ts";
-import { buildNetlifyRedirects } from "../redirects.ts";
+import {
+  buildNetlifyRedirects,
+  netlifyPatternRedirects,
+  platformRedirects,
+} from "../redirects.ts";
 import { distDir, toSiteUrl } from "./paths.ts";
 import type { BuildLog, DeployPlatform, RedirectFile } from "./types.ts";
 
@@ -76,6 +80,33 @@ export const emitNetlifyHeaders = async (
   await writeFile(configPath, JSON.stringify(frameworks), "utf-8");
 };
 
+/**
+ * Carry the pattern redirects (`/beta/:slug*`) into a server build, as
+ * `redirects` in the Frameworks API config: Astro's `redirects` carry only
+ * the exact ones, since it can't prerender a pattern's pages, so the adapter
+ * never writes these. Netlify appends them after any rules of the user's own.
+ */
+export const emitNetlifyPatternRedirects = async (
+  project: BlumeProject
+): Promise<void> => {
+  const ours = netlifyPatternRedirects(platformRedirects(project));
+  const configPath = join(project.context.root, NETLIFY_CONFIG_FILE);
+  if (ours.length === 0 || !existsSync(configPath)) {
+    return;
+  }
+  // Only `redirects` is read; every other key rides through as parsed.
+  const frameworks: { redirects?: { from: string }[] } = JSON.parse(
+    await readFile(configPath, "utf-8")
+  );
+  // A second pass over the same build replaces its own entries.
+  const froms = new Set(ours.map((entry) => entry.from));
+  frameworks.redirects = [
+    ...(frameworks.redirects ?? []).filter((entry) => !froms.has(entry.from)),
+    ...ours,
+  ];
+  await writeFile(configPath, JSON.stringify(frameworks), "utf-8");
+};
+
 /**
  * Netlify. A server build runs on Netlify Functions from the Frameworks API
  * tree the adapter writes to `.netlify/v1`, relative to the Astro root —
@@ -87,7 +118,8 @@ export const emitNetlifyHeaders = async (
  */
 export const netlifyPlatform: DeployPlatform = {
   astro: {
-    config: {},
+    config: () => ({}),
+    configOptions: [],
     options: () => ({}),
     package: NETLIFY_ADAPTER_PACKAGE,
   },
@@ -106,6 +138,7 @@ export const netlifyPlatform: DeployPlatform = {
     // never surfaces it.
     if (!isolated) {
       await emitNetlifyHeaders(project, log);
+      await emitNetlifyPatternRedirects(project);
     }
     return true;
   },

package/src/deploy/platforms/node.ts

@@ -1,3 +1,4 @@
+import type { JsonValue } from "../../core/adapter.ts";
 import { NODE_ADAPTER_PACKAGE } from "../adapters/node.ts";
 import { wrapNodeEntry } from "../node-headers.ts";
 import { clientDir, distDir } from "./paths.ts";
@@ -11,11 +12,20 @@ import type { DeployPlatform } from "./types.ts";
  * discovery files and downloaded SVGs need instead, and answers the
  * configured redirects with their exact status, which Astro's own handler
  * would default to 301 or 308. No platform env to detect: the site URL has to
- * be configured.
+ * be configured. `allowedDomains` becomes Astro's `security.allowedDomains`,
+ * which a server behind a reverse proxy needs before Astro reads the reader's
+ * address from `X-Forwarded-For`.
  */
 export const nodePlatform: DeployPlatform = {
   astro: {
-    config: {},
+    config: ({ allowedDomains }) => {
+      const config: Record<string, JsonValue> = {};
+      if (allowedDomains) {
+        config.security = { allowedDomains };
+      }
+      return config;
+    },
+    configOptions: ["allowedDomains"],
     options: () => ({ mode: "standalone" }),
     package: NODE_ADAPTER_PACKAGE,
   },