_headers

# Cloudflare Pages custom headers
# https://developers.cloudflare.com/pages/configuration/headers/

# HTML — always revalidate (ensures users get latest version)
/index.html
  Cache-Control: public, max-age=0, must-revalidate

/pages/*
  Cache-Control: public, max-age=0, must-revalidate

# Isolated MapLibre/vector-tile rewrite lab. Keep out of search results and
# avoid stale HTML/service-worker files while it is under active development.
/render/
  Cache-Control: public, max-age=0, must-revalidate
  X-Robots-Tag: noindex, nofollow

/render/index.html
  Cache-Control: public, max-age=0, must-revalidate
  X-Robots-Tag: noindex, nofollow

/render/sw.js
  Cache-Control: public, max-age=0, must-revalidate
  Service-Worker-Allowed: /render/
  X-Robots-Tag: noindex, nofollow

/render/build/*
  Cache-Control: public, max-age=31536000, immutable
  X-Robots-Tag: noindex, nofollow

/render/tiles/*
  Cache-Control: public, max-age=31536000, immutable
  X-Robots-Tag: noindex, nofollow

# Temporary compatibility route for pre-promotion /test2 links. Runtime assets
# now live under /app and root /index.html is the production MapLibre shell.
/test2/
  Cache-Control: public, max-age=0, must-revalidate
  X-Robots-Tag: noindex, nofollow

/test2/index.html
  Cache-Control: public, max-age=0, must-revalidate
  X-Robots-Tag: noindex, nofollow

/test2/sw.js
  Cache-Control: public, max-age=0, must-revalidate
  Service-Worker-Allowed: /test2/
  X-Robots-Tag: noindex, nofollow

/app/build/app.bundle.js
  Cache-Control: no-cache, must-revalidate

/app/build/app.bundle.css
  Cache-Control: no-cache, must-revalidate

# Content-hashed, so the filename changes whenever the contents do and a long
# immutable TTL is safe. Stating it explicitly rather than inheriting the default
# also keeps these on the same footing as /render/build/*, which has always had it.
/app/build/chunks/*.js
  Cache-Control: public, max-age=31536000, immutable

/app/build/*.map
  Cache-Control: no-cache, must-revalidate

/app/build/chunks/*.map
  Cache-Control: no-cache, must-revalidate

/app/build/performance-dashboard.json
  Cache-Control: no-cache, must-revalidate

/app/build/mobile-performance-report.json
  Cache-Control: no-cache, must-revalidate

/app/build/chunks/*
  Cache-Control: public, max-age=31536000, immutable

/app/src/*
  Cache-Control: no-cache, must-revalidate

# Safe ONLY because every request for these carries ?v=<content hash of the file>,
# injected at build time (build-test2-app.mjs -> __VIEWER_ASSET_VERSIONS__, and the
# stamped links in maps/index.html). With fixed tokens the edge served a stages2.js hours
# old and a stages.css 43 days old after deploys had changed both.
/app/js/*
  Cache-Control: public, max-age=31536000, immutable

/app/election-viewer-package/*
  Cache-Control: public, max-age=31536000, immutable

/render/metadata/maps-test-index.json
  # Safe ONLY because the client requests this with ?v=<content hash of the
  # file>, injected at build time (build-test2-app.mjs -> __METADATA_INDEX_VERSION__).
  # If that token ever goes back to a hand-edited constant, revert this to
  # max-age=0, must-revalidate -- an immutable stale catalogue cannot be undone
  # from the server side.
  Cache-Control: public, max-age=31536000, immutable
  X-Robots-Tag: noindex, nofollow

/render/metadata/layer-details-test2/*
  Cache-Control: public, max-age=86400, stale-while-revalidate=604800
  X-Robots-Tag: noindex, nofollow

/render/metadata/duplicate-feature-ids/*
  Cache-Control: public, max-age=86400, stale-while-revalidate=604800
  X-Robots-Tag: noindex, nofollow

/render/metadata/elections-test2-summaries/*
  Cache-Control: public, max-age=86400, stale-while-revalidate=604800
  X-Robots-Tag: noindex, nofollow

# Service worker — must revalidate on every load so deploys propagate to all
# clients within one navigation. The SW itself caches downstream resources;
# its own file should never be cached aggressively or we can't ship fixes.
/sw.js
  Cache-Control: no-cache, must-revalidate
  Service-Worker-Allowed: /

# Entry bundles are not filename-fingerprinted. They carry content-derived query
# versions, but must still revalidate so a reused URL cannot strand clients on
# stale dynamic imports.
/build/app.bundle.js
  Cache-Control: no-cache, must-revalidate

/build/app.bundle.js.map
  Cache-Control: no-cache, must-revalidate

/build/main.css
  Cache-Control: no-cache, must-revalidate

/build/main.critical.css
  Cache-Control: no-cache, must-revalidate

/build/about.css
  Cache-Control: no-cache, must-revalidate

# Hashed dynamic JS chunks can cache forever. Keep this scoped below
# /build/chunks/ so stable root entry assets above do not inherit immutable
# caching.
/build/chunks/*
  Cache-Control: public, max-age=31536000, immutable

# Fonts — never change, cache forever
/assets/fonts/*
  Cache-Control: public, max-age=31536000, immutable

# Leaflet CSS + images — versioned in filename, cache forever
/assets/css/leaflet-*
  Cache-Control: public, max-age=31536000, immutable

/assets/css/images/*
  Cache-Control: public, max-age=31536000, immutable

# Map data (FGB files) — immutable once deployed
/data/maps/*
  Cache-Control: public, max-age=31536000, immutable

# Thumbnails — content stable but not fingerprinted. 30 days + stale-while-revalidate
# so repeat visitors don't refetch ~5 MB of PNGs every 4 hours. Append ?v=N to the
# <img src> in ui-controller.js if a thumbnail's content changes.
/assets/thumbnails/*
  Cache-Control: public, max-age=2592000, stale-while-revalidate=86400

# Spatial index chunks — cache for 1 week
/data/database/spatial-index/*
  Cache-Control: public, max-age=604800

# Maps database — must revalidate every load. The previous policy
# (max-age=300, stale-while-revalidate=86400) silently held stale
# copies for up to 24 h after a deploy, hiding newly added catalogue
# entries even after Ctrl+Shift+R. With must-revalidate the browser
# sends If-None-Match each load and the CDN responds 304 (cheap)
# unless the file actually changed.
/data/database/maps.json
  Cache-Control: public, max-age=0, must-revalidate

/data/database/data-entries.json
  Cache-Control: public, max-age=0, must-revalidate

/data/database/books.json
  Cache-Control: public, max-age=0, must-revalidate

/data/database/geographies.json
  Cache-Control: public, max-age=0, must-revalidate

# Spatial index monolithic — fallback, cache for 1 day
/data/database/spatial-index.json
  Cache-Control: public, max-age=86400

# Election data — rarely changes
/data/elections-source/data/*
  Cache-Control: public, max-age=604800

# ------------------------------------------------------------------------------
# Security headers (UX plan T3-02, finding #20)
#
# This file existed but carried CACHE rules only -- not one security directive.
#
# The CSP is deliberately permissive about scripts because the app is not currently
# built for a strict one: the shell uses inline handlers and inline <style>, and
# tightening those is a separate piece of work that would break the site if done
# blind. What is here is the part that can be turned on WITHOUT a rewrite, and it
# still closes the two things that matter most -- framing and transport.
#
#   frame-ancestors 'none'  clickjacking. Also sent as X-Frame-Options for older agents.
#   object-src 'none'       no plugin content, ever.
#   base-uri 'self'         stops an injected <base> retargeting every relative URL.
#   form-action 'self'      an injected form cannot post credentials off-site.
#   upgrade-insecure-requests   no mixed content.
#
# NOT set: default-src/script-src. Adding those before the inline handlers are
# removed would break the map on the first request, and a CSP that has to be
# reverted teaches everyone to distrust the file.
/*
  X-Frame-Options: DENY
  X-Content-Type-Options: nosniff
  Referrer-Policy: strict-origin-when-cross-origin
  Strict-Transport-Security: max-age=31536000; includeSubDomains
  Content-Security-Policy: frame-ancestors 'none'; object-src 'none'; base-uri 'self'; form-action 'self'; upgrade-insecure-requests