_headers

# Cloudflare headers; this deployment is a STAGING url.
# Keep it out of search engines; production will live on benjaminmullins.tv.
/*
  X-Robots-Tag: noindex
  X-Content-Type-Options: nosniff
  Referrer-Policy: strict-origin-when-cross-origin
  # Single self-contained file: only outbound call is the share worker, only
  # framing allowed is our own. inline script/style are 'unsafe-inline' because
  # there's no build step to hash or nonce them; the app has no HTML-injection
  # sinks, so that's an acceptable trade. midi=(self) stays on for Web MIDI.
  Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; connect-src 'self' https://808-share.mullinsben.workers.dev; media-src 'self' blob:; manifest-src 'self'; base-uri 'self'; form-action 'self'; frame-ancestors 'self'; object-src 'none'
  Permissions-Policy: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), midi=(self)

# Always revalidate the HTML so a deploy shows up immediately and the
# installed PWA never gets stuck on a stale build.
/index.html
  Cache-Control: no-cache, must-revalidate
/
  Cache-Control: no-cache, must-revalidate
/manifest.webmanifest
  Cache-Control: no-cache, must-revalidate