_headers

/*
  Content-Security-Policy: default-src 'self'; script-src 'self' https://challenges.cloudflare.com 'sha256-0qFLOnMo4ZqgtC+YMO+1763cr/ZxTi2v7KEhzLIIz4I='; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self'; frame-src https://challenges.cloudflare.com; form-action 'self'; base-uri 'self'; frame-ancestors 'none'; object-src 'none'; worker-src 'self'
  Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
  X-Content-Type-Options: nosniff
  X-Frame-Options: DENY
  Referrer-Policy: no-referrer
  Cross-Origin-Opener-Policy: same-origin
  Cross-Origin-Embedder-Policy: require-corp
  Cross-Origin-Resource-Policy: same-origin
  Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=(), usb=(), accelerometer=(), gyroscope=(), magnetometer=()
  X-DNS-Prefetch-Control: off

# One rule, not two. /data/* and /*.json both matched every shard, and
# Cloudflare concatenated them into
#   Cache-Control: public, max-age=86400, stale-while-revalidate=604800, public, max-age=86400
# -- the same max-age twice, which happened to be harmless only because the two
# rules agreed. Every file under data/ is .json (167 of 167 as of 2026-09-09),
# so this single rule covers the shards and the root JSON (build-info.json,
# .well-known/mcp.json) alike.
/*.json
  Cache-Control: public, max-age=86400, stale-while-revalidate=604800

# Shell JS/CSS use STABLE filenames (no content hash in the name), so a long
# edge cache keeps serving an old deploy's bytes for up to max-age while a
# fresh index.html (max-age=0) references them: new HTML paired with stale
# JS/CSS, which breaks the site for everyone until the TTL expires or the
# cache is purged. These responses carry ETags, so revalidate-always is
# correct-on-deploy with cheap 304s; the service worker provides the
# long-lived client-side cache for repeat visits and offline.
/*.js
  Cache-Control: public, max-age=0, must-revalidate

/styles.css
  Cache-Control: public, max-age=0, must-revalidate

# THERE ARE NO EXACT-PATH OVERRIDES OF Cache-Control HERE, and there must not
# be. This block used to carry two, under a comment claiming that "Cloudflare
# applies every matching rule and the LAST one wins". It does not. Checked
# against production on 2026-09-09, Cloudflare CONCATENATES the values of every
# matching rule into one header, so /manual-j-worker.js was being served
#
#   Cache-Control: public, max-age=0, must-revalidate, public, max-age=3600
#
# -- two conflicting max-age values in one header, where what a cache does with
# a repeated directive is implementation-defined. The 3600 override was never
# reliably in effect, and /sw.js was being served its identical value twice.
#
# So the rule is: ONE rule sets a given header for any given path. The /*.js
# glob above already gives both files exactly what they need -- revalidate
# always, with cheap ETag 304s -- which is what sw.js requires anyway, since the
# browser must re-fetch it on every navigation to detect a new BUILD_HASH.
# check-csp.mjs fails the build if two rules here set the same header for paths
# that can overlap.
/sw.js
  Service-Worker-Allowed: /