# CSP note (#15 reconciled): the WASM app boot is served as an EXTERNAL same-origin module
# (/pahmoi-boot.js), so `script-src 'self' 'wasm-unsafe-eval'` permits it with NO 'unsafe-inline'
# /nonce/hash. The pre-paint theme bootstrap (/boot.js) is likewise external. Keep it that way:
# never inline app scripts, and never add 'unsafe-inline' to script-src. `style-src` no longer
# carries 'unsafe-inline' either (#17): the site_generator replaces the style-hash token below with
# a `'sha256-…'` source for each distinct inline <style> block, computed from the emitted HTML.
# (Naming the token here would spell it, and the fill replaces every occurrence in the file, comment
# included, which is why this sentence describes it instead.)
/*
  X-Frame-Options: DENY
  X-Content-Type-Options: nosniff
  Referrer-Policy: strict-origin-when-cross-origin
  Permissions-Policy: geolocation=(), camera=(), microphone=(), interest-cohort=()
  Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
  Content-Security-Policy: default-src 'self'; script-src 'self' 'wasm-unsafe-eval'; style-src 'self' 'sha256-0ONL80a9xfLLBUTQ9A5vsO+kCEDrertwNY4sB5qUSZI=' 'sha256-X5/DwdnhR7/Qa/rp16VPeCsIq2e57X126QtZaBhadeQ='; img-src 'self' data:; connect-src 'self'; object-src 'none'; frame-ancestors 'none'; base-uri 'self'

# Project SPA artifacts (#631): each static/spa/<name>/ ships verbatim to /spa/<name>/, and the
# site_generator fills the two tokens below with a `'sha256-…'` source per inline <script> and per
# inline <style> in that area, computed from the emitted files. That is what lets a self-contained
# single-file artifact run with NO 'unsafe-inline' anywhere. The rule above is untouched: an
# artifact's hash is a source for its own area and nowhere else.
#
# The detach line is load-bearing. Cloudflare Pages applies EVERY matching rule and joins a header
# set twice with a comma, which a browser reads as two policies enforced together (the intersection
# wins) - so without `! Content-Security-Policy` the inherited hash-less script-src above would
# still block these scripts. Verify at deploy: `curl -sI https://pah.moi/spa/<name>/`.
#
# No 'wasm-unsafe-eval' here, deliberately: that source exists for the site's own WASM engine, which
# an artifact never loads. No 'unsafe-eval' and no 'unsafe-hashes' either - see
# docs/reference/publishing-blog-content.md for what the build-time guard rejects and why. A
# per-artifact relaxation is a recorded owner decision (spec section 10), never a quiet edit here.
/spa/*
  ! Content-Security-Policy
  Content-Security-Policy: default-src 'self'; script-src 'self' 'sha256-BaEMM17M+UQT2CCFaSjxbX3v297Fnstqc33ZmtIsgNs=' 'sha256-JkFc33/R+UIeZvM6sPEudKH01LV0OE1/5FDo5+Qv36M='; style-src 'self' 'sha256-aVQ16e+2aK+Yqk0lBQJK4UDps+7h7EMtFCFvQ0CqrGg=' 'sha256-wOhQKIdwq8XWxKjeXmSRhVByMnOv7SIl6YwyCIUpxfM='; img-src 'self' data:; connect-src 'self'; object-src 'none'; frame-ancestors 'none'; base-uri 'self'
