# Cloudflare Pages serves static assets with `max-age=14400` and ignores any
# Cache-Control set here, which was measured rather than assumed: the CSP below
# arrives on every response, the cache header does not. So the lever for
# style.css and app.js is the version query on their links in index.html, which
# is bumped whenever either file changes. index.html itself is served with
# max-age=0, so a bumped query is picked up on the next visit.

/*
  X-Content-Type-Options: nosniff
  Referrer-Policy: no-referrer
  X-Frame-Options: SAMEORIGIN
  Permissions-Policy: geolocation=(), camera=(), microphone=(), payment=(), usb=()
  # Everything the page runs is either its own or from one of three hosts:
  # jsdelivr for ONNX Runtime and its WebAssembly, Google Fonts for the two
  # typefaces, and Hugging Face for the depth model, fetched only when the
  # visitor asks for depth estimation. Nothing is ever sent anywhere: there is
  # no form action and no endpoint to post an image to.
  Content-Security-Policy: default-src 'self'; script-src 'self' 'wasm-unsafe-eval' https://cdn.jsdelivr.net; worker-src 'self' blob:; style-src 'self' https://fonts.googleapis.com; font-src https://fonts.gstatic.com; img-src 'self' blob: data:; connect-src 'self' https://cdn.jsdelivr.net https://huggingface.co https://*.hf.co; form-action 'none'; frame-ancestors 'self'; base-uri 'none'; object-src 'none'
