# Cloudflare Pages serves these from the published site root (apps/web/dist).

# Sensible security headers on everything.
/*
  X-Content-Type-Options: nosniff
  Referrer-Policy: strict-origin-when-cross-origin
  X-Frame-Options: SAMEORIGIN
  # Keeps a returning visitor off http:// entirely, so they never land in the
  # separate origin whose localStorage has no record of their consent choice
  # (worker/index.ts redirects the first visit; this stops the second).
  # No includeSubDomains: www. is not currently a working host, and forcing
  # https on it would only harden a broken one.
  Strict-Transport-Security: max-age=31536000

# Fingerprinted build assets never change — cache them hard.
/assets/*
  Cache-Control: public, max-age=31536000, immutable

# The browser byte-compares the service worker on every update check. If a CDN
# caches it, updates never reach anyone who already has the app installed.
/sw.js
  Cache-Control: no-cache

/manifest.webmanifest
  Cache-Control: public, max-age=3600
  Content-Type: application/manifest+json

# Unhashed by design — the web app manifest references these paths literally.
/icons/*
  Cache-Control: public, max-age=604800

# Corresponding Source for the deployed build (scripts/source-zip.mjs).
/source.zip
  Content-Type: application/zip
  Content-Disposition: attachment; filename="wooden-surfboard-designer-source.zip"
  Cache-Control: no-cache
