netlify.toml

[build]
  # The IndexNow ping runs here rather than inside `npm run build` so local
  # builds and `npm run verify` stay offline. The script no-ops on any
  # non-production context and never fails the deploy — see scripts/indexnow.mjs.
  command = "npm run build && node scripts/indexnow.mjs"
  publish = "dist"

[build.environment]
  NODE_VERSION = "22.12.0"

# FORM EMAIL NOTIFICATIONS ARE NOT CONFIGURED HERE — AND CANNOT BE.
#
# A previous revision declared `[[notifications]]` blocks in this file to
# route submissions to the studio inbox. Netlify ignored them silently:
# `notifications` is not a supported netlify.toml key. File-based
# configuration accepts only build, plugins, integrations, context,
# redirects, headers, functions, dev, and template
# (https://docs.netlify.com/build/configure-builds/file-based-configuration/).
#
# Form submission notifications are UI-only. Configure them at
# Project configuration > Notifications > Form submission notifications
# (https://docs.netlify.com/manage/forms/notifications/). Because that state
# lives in Netlify and not in this repo, it does NOT travel with a fork,
# a site rename, or a re-link — verify it after any of those.

# The auto-generated Netlify subdomain serves this site's full content on a
# second, crawlable host, which search engines read as duplicate content.
# Redirect it at the edge so matecode.dev is the only origin that answers.
# `force = true` is required: without it the redirect yields to the existing
# static file at that path and never fires.
[[redirects]]
  from = "https://www.matecode.dev/*"
  to = "https://matecode.dev/:splat"
  status = 301
  force = true

[[redirects]]
  from = "https://mate-code.netlify.app/*"
  to = "https://matecode.dev/:splat"
  status = 301
  force = true

# Hashed static assets (fonts, built JS/CSS) are safe to cache forever.
[[headers]]
  for = "/fonts/*"
  [headers.values]
    Cache-Control = "public, max-age=31536000, immutable"

[[headers]]
  for = "/_astro/*"
  [headers.values]
    Cache-Control = "public, max-age=31536000, immutable"

# Baseline security headers for every route.
[[headers]]
  for = "/*"
  [headers.values]
    X-Frame-Options = "DENY"
    X-Content-Type-Options = "nosniff"
    Referrer-Policy = "strict-origin-when-cross-origin"
    Permissions-Policy = "camera=(), microphone=(), geolocation=()"

# Regression guard: Spanish is served at the root `/`, not `/es`. Do NOT add
# a redirect from `/es` here — the prior site broke by redirecting Spanish
# traffic to a route that does not exist. See design.md "File-based i18n".