# multiview.cc — edge headers for Cloudflare Pages and Netlify.
# GitHub Pages ignores this file; see DEPLOY.md.

/*
  X-Content-Type-Options: nosniff
  Referrer-Policy: strict-origin-when-cross-origin
  Permissions-Policy: geolocation=(), microphone=(), camera=(), payment=(), usb=(), fullscreen=(self)
  X-Frame-Options: SAMEORIGIN
  X-Permitted-Cross-Domain-Policies: none
  Strict-Transport-Security: max-age=31536000; includeSubDomains
  Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https: http:; media-src 'self' data: blob: https: http:; font-src 'self' data:; connect-src 'self' blob: data: https: http:; frame-src 'self' about: blob: https: http:; worker-src 'self' blob:; object-src 'none'; base-uri 'none'; form-action 'self'; frame-ancestors 'self'

# The shell must always be revalidated so a deploy is picked up on reload.
/
  Cache-Control: no-cache

/index.html
  Cache-Control: no-cache

/legal.html
  Cache-Control: no-cache

/404.html
  Cache-Control: no-cache

/sw.js
  Cache-Control: no-cache

/.well-known/security.txt
  Content-Type: text/plain; charset=utf-8
  Cache-Control: public, max-age=86400

/multiview-beta.zip
  Cache-Control: public, max-age=86400
  Content-Disposition: attachment; filename="multiview-beta.zip"
  X-Robots-Tag: noindex

# Versioned in the URL (?v=34, ?v=38, ?v=67) — safe to cache for a day.
# Explicit paths rather than *.css / *.js: Cloudflare Pages and Netlify both match
# these reliably, and every file is listed anyway.
/styles.css
  Cache-Control: public, max-age=31536000, immutable

/app.js
  Cache-Control: public, max-age=31536000, immutable

/dashboard.js
  Cache-Control: public, max-age=31536000, immutable

/sources.js
  Cache-Control: public, max-age=31536000, immutable

/sync.js
  Cache-Control: public, max-age=86400

/vendor/hls.min.js
  Cache-Control: public, max-age=31536000, immutable

/*.png
  Cache-Control: public, max-age=604800

