# Cloudflare Pages headers. Applied at the edge — no app code involved.
# Docs: https://developers.cloudflare.com/pages/configuration/headers/

# Hashed build assets never change for a given URL — cache them forever.
/assets/*
  Cache-Control: public, max-age=31536000, immutable

# The HTML shells must always revalidate so a new deploy is picked up instantly.
# (/index.html is the landing page; /app/index.html is the app shell — 2026-07-07 layout.)
/index.html
  Cache-Control: no-cache
/app/index.html
  Cache-Control: no-cache
# Sensible, non-breaking security headers for the whole site.
# (No Content-Security-Policy on purpose: the app fetches user-chosen LLM
#  endpoints and renders arbitrary user media URLs, so a strict CSP would
#  fight the local-first/BYOK design. Add a tailored connect-src/img-src CSP
#  later if you lock down which providers are allowed.)
/*
  X-Content-Type-Options: nosniff
  Referrer-Policy: strict-origin-when-cross-origin
  X-Frame-Options: SAMEORIGIN
  Permissions-Policy: geolocation=(), microphone=(), camera=()

# This exception must follow the global rule: Pages combines every matching
# block in declaration order, and the cross-site host must be frameable only
# by the explicit parent origins named in its CSP.
/aps-viewer-host*
  Cache-Control: no-cache
  Origin-Agent-Cluster: ?1
  ! X-Frame-Options
  Content-Security-Policy: default-src 'none'; script-src 'self' https://developer.api.autodesk.com; style-src 'self' 'unsafe-inline' https://developer.api.autodesk.com; connect-src https://*.autodesk.com https://*.autodesk.io wss://*.autodesk.com; img-src data: blob: https://*.autodesk.com; font-src data: https://developer.api.autodesk.com; frame-ancestors https://flow-graph.com http://localhost:* http://127.0.0.1:*
