/*
  Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
  X-Frame-Options: DENY
  X-Content-Type-Options: nosniff
  Referrer-Policy: strict-origin-when-cross-origin
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=(), browsing-topics=(), payment=()
  # The site has zero executable inline scripts. Structured metadata uses
  # application/ld+json; the code atlas uses same-origin external
  # modules. ``script-src 'self'`` covers both pages without inline handlers. The
  # historical sha256-allow-list got stale (every hash had been
  # collected from inline scripts that have since been removed).
  #
  # Reporting: ``report-to csp-endpoint`` directs browsers to POST
  # violation reports to the matching ``Reporting-Endpoints`` URL.
  # The endpoint at ``/csp-report`` is currently a 404 (no CF worker
  # provisioned yet); browsers will drop on failure. When a sink is
  # wired up — Cloudflare Pages worker logging to a free Loki / Grafana
  # endpoint, or a sentry CSP receiver — this header is already in
  # place. Adds zero overhead until the receiver exists.
  Reporting-Endpoints: csp-endpoint="/csp-report"
  Content-Security-Policy: default-src 'self'; style-src 'self' 'unsafe-inline'; font-src 'self'; img-src 'self' data:; script-src 'self'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; upgrade-insecure-requests; report-to csp-endpoint
  Cross-Origin-Opener-Policy: same-origin
  Cross-Origin-Resource-Policy: same-origin
  # Stable asset URLs change with deployments. Revalidate cached HTML, CSS,
  # modules, fonts and snapshots with ETags instead of mixing releases.
  # One rule also avoids Pages merging conflicting Cache-Control values.
  Cache-Control: public, max-age=0, must-revalidate

# The legacy extensionless discovery route contains the same JSON as its
# .json sibling. Scope its MIME type without changing other asset responses.
/.well-known/mcp-server-card
  Content-Type: application/json

# Keep the inspectable Markdown report readable in a browser rather than
# relying on a provider's default file-type mapping.
/examples/team-replay-report.md
  Content-Type: text/plain; charset=utf-8
