/*
  X-Frame-Options: DENY
  X-Content-Type-Options: nosniff
  Referrer-Policy: strict-origin-when-cross-origin
  Permissions-Policy: camera=(), microphone=(), geolocation=()
  Cross-Origin-Opener-Policy: same-origin

# Hashed build output is safe to cache forever. Without this every
# revisit re-downloaded the full app and the 3.4MB simulation WASM.
/assets/*
  Cache-Control: public, max-age=31536000, immutable

# Never cache the HTML shell - it references the hashed assets above.
/index.html
  Cache-Control: public, max-age=0, must-revalidate

/version.json
  Cache-Control: public, max-age=0, must-revalidate

# Static art keeps fixed names and is cached for a day. The app asks for
# each sheet with ?v=<hash of the file> (src/shared/sprite-url.ts), so a
# redrawn sheet is a new URL and never comes from a stale cache.
/sprites/*
  Cache-Control: public, max-age=86400
