# The passive corpus is public read-only data: allow any origin to fetch it.
/corpus/*
  Access-Control-Allow-Origin: *
  Cache-Control: public, max-age=300

# Downloads must never serve stale from the edge cache — a fixed extension
# build has to reach users the moment it deploys.
/api/*
  Cache-Control: public, max-age=0, must-revalidate

/api/extension/meta
  Content-Type: application/json
  Cache-Control: public, max-age=0, must-revalidate

# SET 50 — per-deploy build identity; polls must not stick on a stale id.
/version.json
  Content-Type: application/json
  Cache-Control: public, max-age=0, must-revalidate

# SET 42d — hashed build assets are content-addressed; cache forever.
# Missing /assets/* must NOT be answered by the SPA (see functions/assets/).
/assets/*
  Cache-Control: public, max-age=31536000, immutable

# HTML shells must revalidate — a stale shell pointing at old hashes is fine
# (old-coherent), but mid-window poison must not stick.
/
  Cache-Control: no-store

/app
  Cache-Control: no-store

/app.html
  Cache-Control: no-store

/index.html
  Cache-Control: no-store

/landing
  Cache-Control: no-store

/landing.html
  Cache-Control: no-store
