/*
  Strict-Transport-Security: max-age=31536000
  Content-Security-Policy: default-src 'self'; base-uri 'self'; connect-src 'self'; font-src 'self'; form-action 'self'; frame-ancestors 'none'; frame-src 'none'; img-src 'self' data:; object-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; upgrade-insecure-requests
  Permissions-Policy: camera=(), geolocation=(), microphone=(), payment=(), usb=()
  Referrer-Policy: strict-origin-when-cross-origin
  X-Content-Type-Options: nosniff
  X-Frame-Options: DENY

# Keep the Worker deployment and version aliases out of the search index; the
# custom domain above is the sole canonical host.
https://:version.:subdomain.workers.dev/*
  X-Robots-Tag: noindex

# Astro fingerprints everything under /_astro, so these URLs are immutable.
/_astro/*
  Cache-Control: public, max-age=31556952, immutable

# Public images keep stable names and may be replaced by a future release.
/*.avif
  Cache-Control: public, max-age=86400, stale-while-revalidate=604800

/*.png
  Cache-Control: public, max-age=86400, stale-while-revalidate=604800

/*.svg
  Cache-Control: public, max-age=86400, stale-while-revalidate=604800

/*.webp
  Cache-Control: public, max-age=86400, stale-while-revalidate=604800
