# Cloudflare Pages static response headers (this file is served from the site root).
# Cross-origin isolation unlocks multi-threaded WASM (SharedArrayBuffer) where the
# browser supports it. Everything still works single-threaded without it.
# "credentialless" (not "require-corp") is used so the OCR model can still be fetched
# cross-origin without CORP headers.
/*
  Cross-Origin-Opener-Policy: same-origin
  Cross-Origin-Embedder-Policy: credentialless
  X-Content-Type-Options: nosniff
  Referrer-Policy: no-referrer

/assets/*
  Cache-Control: public, max-age=31536000, immutable
