blume 2.1.0 → 2.1.2

package/src/core/ui-packs/uk.ts

@@ -50,6 +50,7 @@ export const uk: UIStringsOverride = {
   banner: { dismiss: "Закрити оголошення" },
   changelog: {
     description: "Оновлення продукту та примітки до випусків.",
+    empty: "У журналі змін поки немає записів.",
     title: "Журнал змін",
   },
   consent: {

package/src/core/ui-packs/vi.ts

@@ -49,6 +49,7 @@ export const vi: UIStringsOverride = {
   banner: { dismiss: "Đóng thông báo" },
   changelog: {
     description: "Cập nhật sản phẩm và ghi chú phát hành.",
+    empty: "Chưa có mục nào trong nhật ký thay đổi.",
     title: "Nhật ký thay đổi",
   },
   consent: {

package/src/core/ui-packs/zh-tw.ts

@@ -48,6 +48,7 @@ export const zhTW: UIStringsOverride = {
   banner: { dismiss: "關閉公告" },
   changelog: {
     description: "產品更新與版本說明。",
+    empty: "尚無更新日誌項目。",
     title: "更新日誌",
   },
   consent: {

package/src/core/ui-packs/zh.ts

@@ -48,6 +48,7 @@ export const zh: UIStringsOverride = {
   banner: { dismiss: "关闭公告" },
   changelog: {
     description: "产品更新与版本说明。",
+    empty: "暂无更新日志条目。",
     title: "更新日志",
   },
   consent: {

package/src/deploy/adapter-output.ts

@@ -3,6 +3,7 @@ import { cp, mkdir, rm } from "node:fs/promises";
 
 import { dirname, join } from "pathe";
 
+import { normalizeBasePath } from "../core/base-path.ts";
 import type { ResolvedConfig } from "../core/schema.ts";
 import type { ProjectContext } from "../core/types.ts";
 import type { ResolvedDeployment } from "./adapters/registry.ts";
@@ -30,7 +31,8 @@ export const deployOutputDir = (
  * served. A static build serves `dist/` wherever it lands; a server build
  * serves what its platform declares — the Build Output tree's `static/` half
  * on Vercel, Astro's `build.client` dir (`dist/client/`) on Node and
- * Cloudflare, `dist/` on Netlify.
+ * Cloudflare, `dist/` on Netlify. On Vercel and Cloudflare that's its
+ * `<base>/` directory under `deployment.base`, where the files land.
  */
 export const deployStaticDir = (
   config: ResolvedConfig,
@@ -38,7 +40,10 @@ export const deployStaticDir = (
 ): string => {
   const { deployment } = config;
   return deployment.options.output === "server"
-    ? deployPlatform(deployment).serverStaticDir(context)
+    ? deployPlatform(deployment).serverStaticDir(
+        context,
+        normalizeBasePath(deployment.options.base)
+      )
     : distDir(context);
 };
 

package/src/deploy/adapters/cloudflare.ts

@@ -23,11 +23,13 @@ export const cloudflareAdapterSchema = adapterDescriptorSchema(
 );
 
 /**
- * Cloudflare Workers and Pages. A server build emits a Worker into
- * `dist/server` (with a generated wrapper that answers `Accept:
- * text/markdown`) and serves `dist/client` through the ASSETS binding.
- * `@astrojs/cloudflare` is an optional peer: install it in the project
- * (`npm install @astrojs/cloudflare`).
+ * Cloudflare. A server build targets Workers only (`@astrojs/cloudflare`
+ * dropped Pages in v13): it emits a Worker into `dist/server` (with a
+ * generated wrapper that answers `Accept: text/markdown`) and serves
+ * `dist/client` through the ASSETS binding. A static build
+ * (`output: "static"`) never loads the adapter, and its `dist/` deploys to
+ * Pages or to Workers static assets. `@astrojs/cloudflare` is an optional
+ * peer: install it in the project (`npm install @astrojs/cloudflare`).
  */
 export const cloudflare = (
   options: CloudflareOptions = {}

package/src/deploy/adapters/node.ts

@@ -1,3 +1,5 @@
+import { z } from "zod";
+
 import { adapterDescriptorSchema } from "../../core/adapter.ts";
 import type { DeployAdapter, DeployOptions } from "./types.ts";
 import { deployOptionsSchema, serverRuntimeDeps } from "./types.ts";
@@ -6,18 +8,54 @@ import { deployOptionsSchema, serverRuntimeDeps } from "./types.ts";
 export const NODE_ADAPTER_PACKAGE = "@astrojs/node";
 
 /**
- * Options for {@link node}: `output`, `site`, and `base`, plus any option of
- * `@astrojs/node` forwarded verbatim (`mode`, `staticHeaders`, …). Blume
- * defaults `mode` to `"standalone"`; an option you pass wins. `host` and
- * `port` are forwarded too, but `@astrojs/node` replaces both with Astro's
- * own server settings, so the standalone server listens on `localhost:4321`
- * unless the `HOST` and `PORT` environment variables are set when it starts.
+ * A host the server trusts forwarded headers for, in Astro's
+ * `security.allowedDomains` shape: each field set must match.
  */
-export type NodeOptions = DeployOptions;
+// oxlint-disable-next-line typescript/consistent-type-definitions -- interface loses the implicit index signature a deploy option's JsonValue needs
+export type NodeAllowedDomain = {
+  /** The host, like `docs.example.com`; `*.example.com` matches subdomains. */
+  hostname?: string;
+  /** The port, as a string. */
+  port?: string;
+  /** The scheme, like `https`. */
+  protocol?: string;
+};
 
-export type NodeAdapter = DeployAdapter<"node">;
+/**
+ * Options for {@link node}: `output`, `site`, `base`, and `allowedDomains`,
+ * plus any option of `@astrojs/node` forwarded verbatim (`mode`,
+ * `staticHeaders`, …). Blume defaults `mode` to `"standalone"`; an option you
+ * pass wins. `host` and `port` are forwarded too, but `@astrojs/node`
+ * replaces both with Astro's own server settings, so the standalone server
+ * listens on `localhost:4321` unless the `HOST` and `PORT` environment
+ * variables are set when it starts.
+ */
+export type NodeOptions = DeployOptions & {
+  /**
+   * The hosts a reverse proxy in front of the server answers for, set as
+   * Astro's `security.allowedDomains`. A request whose `Host` (or
+   * `X-Forwarded-Host`) matches one is trusted to name the reader in
+   * `X-Forwarded-For`, which the rate limit counts by; otherwise every
+   * reader counts as the proxy's address. Only list them when a proxy sets
+   * that header on every request, since a reader could otherwise send their
+   * own.
+   */
+  allowedDomains?: NodeAllowedDomain[];
+};
 
-export const nodeOptionsSchema = deployOptionsSchema;
+export type NodeAdapter = DeployAdapter<"node", NodeOptions>;
+
+export const nodeOptionsSchema = deployOptionsSchema.extend({
+  allowedDomains: z
+    .array(
+      z.strictObject({
+        hostname: z.string().min(1).optional(),
+        port: z.string().min(1).optional(),
+        protocol: z.string().min(1).optional(),
+      })
+    )
+    .optional(),
+});
 
 export const nodeAdapterSchema = adapterDescriptorSchema(
   "node",

package/src/deploy/adapters/types.ts

@@ -84,13 +84,17 @@ const NAMED_OPTIONS = new Set(["base", "output", "site"]);
 
 /**
  * The options Blume does not name — what reaches the `@astrojs/*` adapter's
- * constructor verbatim.
+ * constructor verbatim. `configOptions` are the ones a host adapter names
+ * itself, for the Astro config rather than the constructor.
  */
 export const deployPassthrough = (
-  options: DeployOptions
+  options: DeployOptions,
+  configOptions: readonly string[] = []
 ): Record<string, JsonValue> =>
   Object.fromEntries(
-    Object.entries(options).filter(([key]) => !NAMED_OPTIONS.has(key))
+    Object.entries(options).filter(
+      ([key]) => !(NAMED_OPTIONS.has(key) || configOptions.includes(key))
+    )
   );
 
 /**

package/src/deploy/artifacts.ts

@@ -445,7 +445,8 @@ export const publishBuildArtifacts = async (
   await buildNarration(project, distDir, logger);
 
   // Upload the index to a hosted provider (Algolia, Orama Cloud, Typesense).
-  // Skipped with a warning when its admin key isn't configured.
+  // Skipped with a warning when its admin key isn't configured; with the key
+  // set, a failed sync fails the build.
   await syncSearchProvider(project, {
     start: logger.info.bind(logger),
     success: logger.info.bind(logger),

package/src/deploy/cloudflare-negotiation.ts

@@ -40,8 +40,9 @@
  * Cloudflare does not apply `_headers` to worker-first routes, so the wrapper
  * also re-stamps what the static layer would otherwise add on the routes it
  * takes over: the homepage agent-discovery `Link` header, the Markdown
- * `charset=utf-8`, and the sandbox on the SVGs a content source downloaded
- * (see `deploy/headers.ts`). The raw `.md`/`.mdx` URLs are
+ * `charset=utf-8`, the sandbox on the SVGs a content source downloaded (see
+ * `deploy/headers.ts`), and `X-Powered-By` unless `poweredBy` is `false`. The
+ * raw `.md`/`.mdx` URLs are
  * exempted from worker-first routing with negative rules, keeping their
  * `_headers` treatment and their zero-Worker serving path.
  *
@@ -85,6 +86,7 @@ import {
   OPENAPI_PATH,
 } from "../ai/api/paths.ts";
 import { normalizeBasePath, normalizePath } from "../core/base-path.ts";
+import { POWERED_BY_HEADERS } from "../core/powered-by.ts";
 import { compileRedirects, isPatternPath } from "../core/redirect-patterns.ts";
 import { CONTENT_ASSETS_ROOT, SVG_ASSET_HEADERS } from "./headers.ts";
 import type { NotFoundVariants } from "./vercel-negotiation.ts";
@@ -244,6 +246,8 @@ export interface NegotiationWorkerOptions {
   base?: string;
   /** Homepage agent-discovery `Link` header (see `ai/link-headers.ts`). */
   homeLinkHeader?: string | null;
+  /** Whether responses identify Blume with `X-Powered-By`. Defaults to `true`. */
+  poweredBy?: boolean;
   /** Estimated token count of the homepage Markdown mirror. */
   homeTokens?: number;
   /** Configured redirects the wrapper answers with their exact status. */
@@ -277,6 +281,9 @@ export const buildNegotiationWorker = (
   const binding = JSON.stringify(options.assetsBinding);
   const prefix = JSON.stringify(encodeURI(normalizeBasePath(options.base)));
   const homeLinkHeader = JSON.stringify(options.homeLinkHeader ?? null);
+  const poweredBy = JSON.stringify(
+    options.poweredBy === false ? {} : POWERED_BY_HEADERS
+  );
   const homeTokens = JSON.stringify(
     options.homeTokens === undefined ? null : String(options.homeTokens)
   );
@@ -331,6 +338,7 @@ const PATTERN_REDIRECTS = ${patternRedirects}.map(
 );
 const NOT_FOUND = ${notFound};
 const SVG_ASSET_HEADERS = ${JSON.stringify(SVG_ASSET_HEADERS)};
+const POWERED_BY = ${poweredBy};
 
 // An SVG a content source downloaded: a document that could run script as the
 // docs site if opened directly, so it goes out sandboxed. Matched on the
@@ -542,12 +550,30 @@ const isHomePath = (pathname) => {
   return rest === "" || rest === "/";
 };
 
+// Blume's X-Powered-By, on every answer the wrapper gives unless the
+// response already names its own (the project's middleware, say).
+const identify = (headers) => {
+  for (const [name, value] of Object.entries(POWERED_BY)) {
+    if (!headers.has(name)) {
+      headers.set(name, value);
+    }
+  }
+};
+
 const withHeaders = (response, apply) => {
   const patched = new Response(response.body, response);
   apply(patched.headers);
+  identify(patched.headers);
   return patched;
 };
 
+// A response that already carries the header (Blume's runtime middleware sets
+// it on every page Astro renders) goes out as it is.
+const withPoweredBy = (response) =>
+  Object.keys(POWERED_BY).every((name) => response.headers.has(name))
+    ? response
+    : withHeaders(response, () => {});
+
 export default {
   async fetch(request, env, context) {
     const url = new URL(request.url);
@@ -556,7 +582,10 @@ export default {
     const redirect = redirectFor(url.pathname);
     if (redirect !== null) {
       return new Response(null, {
-        headers: { location: redirectLocation(redirect[0], url.search) },
+        headers: {
+          ...POWERED_BY,
+          location: redirectLocation(redirect[0], url.search),
+        },
         status: redirect[1],
       });
     }
@@ -568,7 +597,7 @@ export default {
       });
     }
     if (request.method !== "GET" && request.method !== "HEAD") {
-      return server.fetch(request, env, context);
+      return withPoweredBy(await server.fetch(request, env, context));
     }
     const assets = env[ASSETS_BINDING];
     // The request goes through untouched, so a conditional revalidation
@@ -577,7 +606,7 @@ export default {
     if (assets !== undefined && isPageJson(url.pathname)) {
       const asset = await assets.fetch(request);
       if (asset.status !== 404) {
-        return asset;
+        return withPoweredBy(asset);
       }
     }
     const variant = markdownVariantUrl(url.pathname + url.search);
@@ -608,10 +637,10 @@ export default {
     const response = await server.fetch(request, env, context);
     const twin = await notFoundTwin(request, url, response, assets);
     if (twin !== null) {
-      return twin;
+      return withPoweredBy(twin);
     }
     if (variant === null && !(home && HOME_LINK_HEADER !== null)) {
-      return response;
+      return withPoweredBy(response);
     }
     return withHeaders(response, (headers) => {
       if (variant !== null) {

package/src/deploy/headers.ts

@@ -10,6 +10,7 @@ import {
   SIGNATURES_DIRECTORY_TYPE,
 } from "../ai/web-bot-auth.ts";
 import { normalizeBasePath } from "../core/base-path.ts";
+import { POWERED_BY_HEADERS } from "../core/powered-by.ts";
 import type { ResolvedConfig } from "../core/schema.ts";
 
 /**
@@ -98,6 +99,13 @@ export const headerRules = (
     path: `${deployBase}/*.${rule.ext}`,
     value: rule.contentType,
   }));
+  // One rule for the whole site: `/*` matches the homepage too, and a host
+  // that joins the values of overlapping rules would send a second one twice.
+  if (config.poweredBy) {
+    for (const [name, value] of Object.entries(POWERED_BY_HEADERS)) {
+      rules.push({ name, path: `${deployBase}/*`, value });
+    }
+  }
   if (homeLinkHeader) {
     rules.push({ name: "Link", path: `${deployBase}/`, value: homeLinkHeader });
   }
@@ -212,9 +220,15 @@ export const escapeVercelSource = (path: string): string =>
  * A `_headers` path as a `vercel.json` `source`, which `path-to-regexp` reads:
  * the literal parts are escaped, and a `*` glob becomes the `(.*)` group that
  * spans path segments as the glob does. An exact directory path (the homepage
- * rule's `/docs/`) drops its trailing slash, the URL Vercel serves it at.
+ * rule's `/docs/`) drops its trailing slash, the URL Vercel serves it at. A
+ * whole-directory glob (`/docs/*`) becomes an optional group,
+ * `/docs/:path(.*)?`, so it matches that bare URL as well as every path
+ * beneath it.
  */
 const vercelSource = (path: string): string => {
+  if (path.endsWith("/*")) {
+    return `${escapeVercelSource(path.slice(0, -2))}/:path(.*)?`;
+  }
   const trimmed =
     path.length > 1 && path.endsWith("/") ? path.slice(0, -1) : path;
   return trimmed.split("*").map(escapeVercelSource).join("(.*)");

package/src/deploy/node-headers.ts

@@ -14,6 +14,7 @@ import {
   SIGNATURES_DIRECTORY_TYPE,
 } from "../ai/web-bot-auth.ts";
 import { normalizeBasePath, normalizePath } from "../core/base-path.ts";
+import { POWERED_BY_HEADERS } from "../core/powered-by.ts";
 import type { BlumeProject } from "../core/project-graph.ts";
 import { compileRedirects, isPatternPath } from "../core/redirect-patterns.ts";
 import type { CompiledRedirect } from "../core/redirect-patterns.ts";
@@ -159,6 +160,8 @@ export const nodePatternRedirects = (
 export interface NodeEntryOptions {
   /** `deployment.base`, normalized (`""` at the root). */
   base?: string;
+  /** Whether responses identify Blume with `X-Powered-By`. Defaults to `true`. */
+  poweredBy?: boolean;
   /** The configured redirects, from {@link nodeRedirects}. */
   redirects?: NodeRedirects;
   /** The configured pattern redirects, from {@link nodePatternRedirects}. */
@@ -169,7 +172,12 @@ export interface NodeEntryOptions {
  * The entry that replaces Astro's: it answers a configured redirect with its
  * exact status, and otherwise stamps the rules' headers on the response and
  * hands the request to Astro's handler. `send` leaves a Content-Type that is
- * already set alone, so the registered media type wins.
+ * already set alone, so the registered media type wins. Unless `poweredBy` is
+ * `false`, every answer also names Blume in `X-Powered-By` — the redirects,
+ * and the prerendered pages and files the static handler serves, which
+ * Blume's runtime middleware never sees. A middleware-mode entry leaves that
+ * header to the middleware: Astro hands a request it has no route for back to
+ * the host app through `next()`, and that response is the host's own.
  *
  * A rule matches the file the static handler will serve, not the raw URL:
  * Astro strips the base when it leads the path and serves the rest from the
@@ -194,10 +202,11 @@ export const nodeEntryWrapper = (
 // This wrapper answers the configured redirects with their exact status and
 // sets the headers the standalone server's static handler can't (the media
 // types and CORS headers of the .well-known discovery files, the sandbox on
-// downloaded SVGs), then hands every other request to Astro.
+// downloaded SVGs, X-Powered-By), then hands every other request to Astro.
 import { posix } from "node:path";
 
 const BASE = ${JSON.stringify(options.base ?? "")};
+const POWERED_BY = ${JSON.stringify(options.poweredBy === false ? {} : POWERED_BY_HEADERS)};
 const RULES = new Map(${JSON.stringify(exactRules(rules))});
 const PATTERNS = ${JSON.stringify(patternRules(rules))};
 const REDIRECTS = ${JSON.stringify(options.redirects ?? {})};
@@ -221,20 +230,20 @@ const servedPath = (req) => {
       : path;
   return BASE + (rest || "/");
 };
-const applyHeaders = (req, res) => {
+const applyHeaders = (req, res, identify) => {
   const path = servedPath(req);
   const lower = path.toLowerCase();
-  const headers =
-    RULES.get(path) ??
-    PATTERNS.find(
-      ([prefix, suffix]) =>
-        lower.startsWith(prefix.toLowerCase()) &&
-        lower.endsWith(suffix.toLowerCase())
-    )?.[2];
-  if (headers) {
-    for (const [name, value] of Object.entries(headers)) {
-      res.setHeader(name, value);
-    }
+  const headers = {
+    ...(identify ? POWERED_BY : {}),
+    ...(RULES.get(path) ??
+      PATTERNS.find(
+        ([prefix, suffix]) =>
+          lower.startsWith(prefix.toLowerCase()) &&
+          lower.endsWith(suffix.toLowerCase())
+      )?.[2]),
+  };
+  for (const [name, value] of Object.entries(headers)) {
+    res.setHeader(name, value);
   }
 };
 // A pattern redirect's Location: its template, each $n filled with that
@@ -268,7 +277,7 @@ const answerRedirect = (req, res) => {
     return false;
   }
   const [location, status] = redirect;
-  res.writeHead(status, { location });
+  res.writeHead(status, { ...POWERED_BY, location });
   res.end();
   return true;
 };
@@ -285,7 +294,7 @@ export const handler = (req, res, ...rest) => {
   if (answerRedirect(req, res)) {
     return;
   }
-  applyHeaders(req, res);
+  applyHeaders(req, res, options.mode !== "middleware");
   return astro.handler(req, res, ...rest);
 };
 export const startServer = () => {
@@ -301,7 +310,7 @@ export const startServer = () => {
       if (answerRedirect(req, res)) {
         return;
       }
-      applyHeaders(req, res);
+      applyHeaders(req, res, true);
       for (const listener of astroListeners) {
         listener.call(httpServer, req, res);
       }
@@ -315,9 +324,10 @@ if (options.mode === "standalone" && previous !== "disabled") {
 `;
 
 /**
- * Put the wrapper in front of a Node server build's entry. A build with no
- * rule (no API catalog, AI catalog, MCP server, signatures directory, or
- * downloaded content assets) and no redirect leaves Astro's entry alone.
+ * Put the wrapper in front of a Node server build's entry. A build with
+ * `poweredBy` off, no rule (no API catalog, AI catalog, MCP server,
+ * signatures directory, or downloaded content assets), and no redirect leaves
+ * Astro's entry alone.
  */
 export const wrapNodeEntry = async (
   project: BlumeProject,
@@ -341,6 +351,7 @@ export const wrapNodeEntry = async (
   const redirects = nodeRedirects(project);
   const patternRedirects = nodePatternRedirects(project);
   if (
+    !project.config.poweredBy &&
     rules.length === 0 &&
     Object.keys(redirects).length === 0 &&
     patternRedirects.length === 0
@@ -365,6 +376,7 @@ export const wrapNodeEntry = async (
     nodeEntryWrapper(rules, {
       base: normalizeBasePath(project.config.deployment.options.base),
       patternRedirects,
+      poweredBy: project.config.poweredBy,
       redirects,
     }),
     "utf-8"

package/src/deploy/platforms/cloudflare.ts

@@ -122,6 +122,7 @@ export const emitCloudflareNegotiation = async (
             )
             .map((route) => pageJsonPath(route.path))
         : [],
+      poweredBy: config.poweredBy,
       // The wrapper Worker matches full served URLs, so the redirects are
       // based the same way the platform files are — it answers any the
       // worker-first rules claim, where `_redirects` is never consulted and
@@ -305,17 +306,21 @@ export const bindCloudflareRateLimit = async (
 };
 
 /**
- * Cloudflare Workers and Pages. A server build emits the Worker into
- * `dist/server` and serves `dist/client` through the ASSETS binding, which
- * honors `_headers` from that directory exactly as Pages does — so the file
- * applies to both output modes here. Without a configured driver the adapter
- * force-enables KV-backed sessions and declares a `SESSION` binding that
- * `wrangler deploy` then demands a namespace for, even though Blume never
- * reads `Astro.session`; `session: false` opts the project out.
+ * Cloudflare. A server build targets Workers only (`@astrojs/cloudflare`
+ * dropped Pages in v13): it emits the Worker into `dist/server` and serves
+ * `dist/client` through the ASSETS binding, which honors `_headers` from that
+ * directory exactly as Pages does — so the file applies to both output modes
+ * here. A static build never loads the adapter; its `dist/` deploys to Pages,
+ * whose build environment `env` detects, or to Workers static assets (Workers
+ * Builds exposes no site URL to detect). Without a configured driver the
+ * adapter force-enables KV-backed sessions and declares a `SESSION` binding
+ * that `wrangler deploy` then demands a namespace for, even though Blume
+ * never reads `Astro.session`; `session: false` opts the project out.
  */
 export const cloudflarePlatform: DeployPlatform = {
   astro: {
-    config: { session: false },
+    config: () => ({ session: false }),
+    configOptions: [],
     options: adapterOptions,
     package: CLOUDFLARE_ADAPTER_PACKAGE,
   },
@@ -350,5 +355,5 @@ export const cloudflarePlatform: DeployPlatform = {
   // build, and hoists its own `_headers`/`_redirects` back up to `dist/client`.
   serverClientUnderBase: true,
   serverOutputDir: distDir,
-  serverStaticDir: clientDir,
+  serverStaticDir: (context, base) => join(clientDir(context), base),
 };

package/src/deploy/platforms/netlify.ts

@@ -118,7 +118,8 @@ export const emitNetlifyPatternRedirects = async (
  */
 export const netlifyPlatform: DeployPlatform = {
   astro: {
-    config: {},
+    config: () => ({}),
+    configOptions: [],
     options: () => ({}),
     package: NETLIFY_ADAPTER_PACKAGE,
   },

package/src/deploy/platforms/node.ts

@@ -1,3 +1,4 @@
+import type { JsonValue } from "../../core/adapter.ts";
 import { NODE_ADAPTER_PACKAGE } from "../adapters/node.ts";
 import { wrapNodeEntry } from "../node-headers.ts";
 import { clientDir, distDir } from "./paths.ts";
@@ -11,11 +12,20 @@ import type { DeployPlatform } from "./types.ts";
  * discovery files and downloaded SVGs need instead, and answers the
  * configured redirects with their exact status, which Astro's own handler
  * would default to 301 or 308. No platform env to detect: the site URL has to
- * be configured.
+ * be configured. `allowedDomains` becomes Astro's `security.allowedDomains`,
+ * which a server behind a reverse proxy needs before Astro reads the reader's
+ * address from `X-Forwarded-For`.
  */
 export const nodePlatform: DeployPlatform = {
   astro: {
-    config: {},
+    config: ({ allowedDomains }) => {
+      const config: Record<string, JsonValue> = {};
+      if (allowedDomains) {
+        config.security = { allowedDomains };
+      }
+      return config;
+    },
+    configOptions: ["allowedDomains"],
     options: () => ({ mode: "standalone" }),
     package: NODE_ADAPTER_PACKAGE,
   },

package/src/deploy/platforms/types.ts

@@ -2,7 +2,10 @@ import type { JsonValue } from "../../core/adapter.ts";
 import type { BlumeProject } from "../../core/project-graph.ts";
 import type { ResolvedConfig } from "../../core/schema.ts";
 import type { ProjectContext } from "../../core/types.ts";
-import type { DeployAdapterKind } from "../adapters/registry.ts";
+import type {
+  DeployAdapterKind,
+  ResolvedDeployOptions,
+} from "../adapters/registry.ts";
 import type { DeployOutput } from "../adapters/types.ts";
 
 /**
@@ -15,8 +18,16 @@ import type { DeployOutput } from "../adapters/types.ts";
 
 /** How the generated `astro.config.mjs` constructs the `@astrojs/*` adapter. */
 export interface AstroAdapterSpec {
-  /** Top-level `defineConfig` entries the adapter needs beside itself. */
-  config: Record<string, JsonValue>;
+  /**
+   * Top-level `defineConfig` entries the adapter needs beside itself, some
+   * of them set from the deployment's own options.
+   */
+  config: (options: ResolvedDeployOptions) => Record<string, JsonValue>;
+  /**
+   * The deployment options `config` reads, which therefore stay out of the
+   * passthrough to the `@astrojs/*` constructor.
+   */
+  configOptions: string[];
   /** Blume's own constructor options; the user's passthrough is spread over them. */
   options: (context: ProjectContext) => Record<string, JsonValue>;
   /** The package the config imports the adapter from. */
@@ -115,13 +126,16 @@ export interface DeployPlatform {
   /**
    * Whether the adapter moves a server build's client output under
    * `deployment.base` (`dist/client/<base>/`, the directory Astro then hands
-   * `astro:build:done`) while the platform keeps serving `serverStaticDir`
-   * as the assets root. The files the platform reads there, like `_headers`,
+   * `astro:build:done`) while the platform keeps serving `dist/client` as
+   * the assets root. The files the platform reads there, like `_headers`,
    * belong above the directory Astro reports.
    */
   serverClientUnderBase: boolean;
   /** Where a server build's deploy bundle lands. */
   serverOutputDir: (context: ProjectContext) => string;
-  /** The directory a server build serves as static files. */
-  serverStaticDir: (context: ProjectContext) => string;
+  /**
+   * The directory a server build serves as static files, given the normalized
+   * `deployment.base` for a platform that serves them from `<dir>/<base>/`.
+   */
+  serverStaticDir: (context: ProjectContext, base: string) => string;
 }