_headers

/*
  X-Content-Type-Options: nosniff
  Referrer-Policy: strict-origin-when-cross-origin
  Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
  X-Frame-Options: DENY
  Content-Security-Policy: frame-ancestors 'none'
  Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=()

# Vendored runtime uses versioned filenames (e.g. react-18.3.1...js), so a new
# version is a new URL — safe to cache forever. Cuts ~7 RTTs for returning
# visitors. NB: og-card.png is unversioned and lives at root, so it is NOT
# covered here on purpose.
/vendor/*
  Cache-Control: public, max-age=31536000, immutable

# Unversioned first-party scripts (change only on deploy). Without this they
# served max-age=0, so every repeat visit paid one conditional request per file
# (13 RTTs gating script execution — beacon.js is even render-blocking).
# stale-while-revalidate lets returning browsers run the cached copy instantly
# and refresh in the background. Mixed-version risk is bounded: a visit fetches
# all of these together, so a returning browser holds a self-consistent set,
# ≤5 min behind at worst once the background revalidation lands. The HTML stays
# max-age=0 (not listed) so a deploy still shows up on the next navigation.
/dist/*
  Cache-Control: public, max-age=300, stale-while-revalidate=86400
/game-data.js
  Cache-Control: public, max-age=300, stale-while-revalidate=86400
/result-state.js
  Cache-Control: public, max-age=300, stale-while-revalidate=86400
/playa-address.js
  Cache-Control: public, max-age=300, stale-while-revalidate=86400
/beacon.js
  Cache-Control: public, max-age=300, stale-while-revalidate=86400
/admin/aggregate.js
  Cache-Control: public, max-age=300, stale-while-revalidate=86400
/shared.css
  Cache-Control: public, max-age=300, stale-while-revalidate=86400
/favicon.svg
  Cache-Control: public, max-age=300, stale-while-revalidate=86400

# Icons and crawler files: requested repeatedly by browsers, bots, and link
# unfurlers, and they change about never, so a day of cache saves a conditional
# request per visit. favicon.ico and apple-touch-icon-precomposed.png exist only
# because clients request those exact paths whether or not the HTML points at
# them — both were 404ing into the Worker.
/favicon.ico
  Cache-Control: public, max-age=86400
/apple-touch-icon.png
  Cache-Control: public, max-age=86400
/apple-touch-icon-precomposed.png
  Cache-Control: public, max-age=86400
/sitemap.xml
  Cache-Control: public, max-age=86400
/llms.txt
  Cache-Control: public, max-age=86400
/robots.txt
  Cache-Control: public, max-age=86400

# NB: an X-Robots-Tag for /result/ does NOT belong here. wrangler.jsonc sets
# assets.run_worker_first:["/result/"], so that route is served by the Worker
# through env.ASSETS.fetch(), which bypasses the asset layer that applies this
# file. #110 shipped the entry here and it silently did nothing in production.
# The noindex lives as a <meta name="robots"> in result/index.html instead (#111).

# Wrangler infers text/jsx for .jsx, which is not on Cloudflare's compressible
# MIME list, so this file was shipping uncompressed (~144KB raw vs ~40KB).
# (The matching /green-radius.jsx entry was removed once .assetsignore stopped
# serving that path — the entry matched only a 404.)
/admin/admin.jsx
  Content-Type: text/javascript; charset=utf-8