/*
  X-Content-Type-Options: nosniff
  Strict-Transport-Security: max-age=31536000
  Referrer-Policy: no-referrer
  X-Frame-Options: SAMEORIGIN
  Cross-Origin-Opener-Policy: same-origin
  Cross-Origin-Embedder-Policy: require-corp
  Permissions-Policy: microphone=(self), camera=(), geolocation=()
  Content-Security-Policy: default-src 'self'; script-src 'self' 'wasm-unsafe-eval'; style-src 'self' 'unsafe-inline'; font-src 'self'; connect-src 'self' wss://teleprompter.special.lu https://download.moonshine.ai https://huggingface.co https://*.huggingface.co https://*.hf.co; worker-src 'self' blob:; img-src 'self' data: blob:; media-src 'self' blob:; object-src 'none'; base-uri 'self'; frame-ancestors 'self'
  Cache-Control: no-cache

# The pinned Embind runtime compiles JS invokers inside these two worker entry
# points. Detach the inherited CSP before replacing it; duplicate CSP values
# are intersected by browsers. Document scripts keep the strict policy above.
/vendor/moonshine/stt-worker.js
  ! Content-Security-Policy
  Content-Security-Policy: default-src 'none'; script-src 'self' 'wasm-unsafe-eval' 'unsafe-eval'; connect-src 'self' https://download.moonshine.ai; worker-src 'self'; object-src 'none'; base-uri 'none'

/vendor/moonshine/moonshine.mjs
  ! Content-Security-Policy
  Content-Security-Policy: default-src 'none'; script-src 'self' 'wasm-unsafe-eval' 'unsafe-eval'; connect-src 'self'; worker-src 'self'; object-src 'none'; base-uri 'none'

/assets/*
  Cache-Control: public, max-age=31536000, immutable

/ai-guide.md
  Content-Type: text/markdown; charset=utf-8
  Cache-Control: no-cache

/llms.txt
  Content-Type: text/plain; charset=utf-8
  Cache-Control: no-cache

/examples/ai-script.json
  Content-Type: application/json; charset=utf-8
  Cache-Control: no-cache

/source.zip
  Content-Type: application/zip
  Content-Disposition: attachment; filename="Cue-Studio-1.12.1-source.zip"

/mcp-guide.md
  Content-Type: text/markdown; charset=utf-8
  Cache-Control: no-cache
