# Cloudflare Pages response headers (deploy root). Rationale: docs/SECURITY.md.
# style-src hash = the <noscript><style> block in index.html; recompute if it changes:
#   echo -n '#pre{display:none}#film{height:auto!important}' | openssl dgst -sha256 -binary | base64
# When brand.js sets bookingUrl, add that origin to form-action, or the booking form cannot submit.
/*
  Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'sha256-h0jm8mQEFhxw1ttYEroIl2WbAoCx2BTMJ04DGOoxWnQ='; img-src 'self' data:; font-src 'self'; media-src 'self' blob:; connect-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'
  X-Content-Type-Options: nosniff
  Referrer-Policy: strict-origin-when-cross-origin
  Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=()
  Strict-Transport-Security: max-age=31536000
# Vendored libraries carry their version in the folder history, not the name: one day, then revalidate.
/vendor/*
  Cache-Control: public, max-age=86400
# Film frames and photos have no content hash in their names, so a re-render must not be stuck behind "immutable".
/assets/*
  Cache-Control: public, max-age=86400, stale-while-revalidate=604800
