# Cloudflare Pages headers (https://developers.cloudflare.com/pages/configuration/headers/)
# Order matters: most specific first.

# Hashed Astro assets are content-addressed; safe to cache forever.
/_astro/*
  Cache-Control: public, max-age=31536000, immutable

# Static assets that aren't fingerprinted: 1 hour, allow CDN to revalidate.
/img/*
  Cache-Control: public, max-age=3600, must-revalidate
/fonts/*
  Cache-Control: public, max-age=2592000, immutable
/favicon.svg
  Cache-Control: public, max-age=86400

# llms.txt and robots.txt should be checked daily.
/llms.txt
  Cache-Control: public, max-age=86400
  Content-Type: text/plain; charset=utf-8
/robots.txt
  Cache-Control: public, max-age=86400

# Sitemap: revalidate frequently so search/LLM crawlers see fresh URLs.
/sitemap-index.xml
  Cache-Control: public, max-age=3600
/sitemap-*.xml
  Cache-Control: public, max-age=3600

# HTML pages: short browser cache, longer edge cache; Cloudflare honours
# both via cdn-cache-control. Adjust max-age if you need fresher updates.
/*
  X-Frame-Options: SAMEORIGIN
  X-Content-Type-Options: nosniff
  Referrer-Policy: strict-origin-when-cross-origin
  Permissions-Policy: geolocation=(), microphone=(), camera=()
  Cache-Control: public, max-age=300, must-revalidate
  CDN-Cache-Control: public, max-age=86400
