_headers

/*
  X-Content-Type-Options: nosniff
  Referrer-Policy: strict-origin-when-cross-origin
  Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
  X-Frame-Options: DENY
  Permissions-Policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), camera=(), display-capture=(), document-domain=(), encrypted-media=(), fullscreen=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), web-share=(), xr-spatial-tracking=()
  Cache-Control: public, max-age=0, s-maxage=600, must-revalidate

# The one place `immutable` is exactly right: Vite content-hashes these
# filenames, so a changed file is a changed URL and the cached copy can never
# go stale. Everything else on the site has a stable filename, which is why it
# gets a month rather than a year. Without this rule the bundles fell through
# to the blanket revalidation above and cost a conditional request each per
# visit.
/_app/immutable/*
  ! Cache-Control
  Cache-Control: public, max-age=31536000, immutable

# Fonts and raster art are byte-stable between deploys, so the blanket
# revalidation above buys nothing and costs a conditional request per file per
# visit. A month of caching, not a year with `immutable`, because the filenames
# are stable rather than content-hashed — a rebuilt font reaches readers within
# 30 days instead of never.
/fonts/*
  ! Cache-Control
  Cache-Control: public, max-age=2592000

# Social cards are regenerated on every build but only ever fetched by a
# scraper, which re-reads them when the page changes rather than on a schedule.
/og/*
  ! Cache-Control
  Cache-Control: public, max-age=2592000

/*.webp
  ! Cache-Control
  Cache-Control: public, max-age=2592000

/*.png
  ! Cache-Control
  Cache-Control: public, max-age=2592000

# The favicon set, for the same reason — it is the last few KiB Lighthouse
# still flags under inefficient cache lifetimes.
/*.svg
  ! Cache-Control
  Cache-Control: public, max-age=2592000

/*.ico
  ! Cache-Control
  Cache-Control: public, max-age=2592000

# RSS declares its own cache intent (max-age=3600 in its route handler). The
# blanket /* rule would override it; `! Cache-Control` strips that value so the
# feed's wins. sitemap.xml sets no cache header and keeps the /* revalidation.
/rss.xml
  ! Cache-Control
  Cache-Control: public, max-age=3600

# Per-tag feeds set the same max-age in their route handler. Without this they
# inherit the blanket HTML revalidation, which is what production currently
# ships for /posts/tag/*/rss.xml.
/posts/tag/*/rss.xml
  ! Cache-Control
  Cache-Control: public, max-age=3600