Repository navigation
Expand file tree
/
Copy path_headers
More file actions
111 lines (102 loc) · 5.32 KB
/
Copy path_headers
File metadata and controls
111 lines (102 loc) · 5.32 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
# Cloudflare Pages headers — applied to all routes.
#
# GA4 gtag.js (G-Z77ETCDJYL). The /* policy follows Google's GA4 rules
# without Google Signals or ads hosts. The tag host must stay listed in
# seo_lint.ALLOWED_SCRIPT_SRC.
/*
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: interest-cohort=()
Content-Security-Policy: default-src 'self' blob:; style-src 'self' blob: https://fonts.googleapis.com 'unsafe-inline'; font-src 'self' blob: https://fonts.gstatic.com; img-src 'self' blob: data: https://*.google-analytics.com https://*.googletagmanager.com; script-src 'self' blob: 'unsafe-inline' https://static.cloudflareinsights.com https://*.googletagmanager.com; connect-src 'self' blob: https://cloudflareinsights.com https://api.github.com https://*.google-analytics.com https://*.analytics.google.com https://*.googletagmanager.com; frame-ancestors 'self';
# Site-wide stylesheet changes with the design — must revalidate on
# every deploy (ETag 304s keep this cheap). A stale copy here breaks
# layout for new markup (seen 2026-07-04 with the hero video).
/style.css
Cache-Control: no-cache
# Playground JS/CSS change on every deploy — must revalidate.
/playground/*.js
Cache-Control: no-cache
/playground/*.css
Cache-Control: no-cache
/playground/*.html
Cache-Control: no-cache
# Playground static assets (fonts, images) can cache longer.
/playground/assets/*.woff2
Cache-Control: public, max-age=86400
# The root index.html IS the encrypted payload — it changes every
# deploy and must never be served stale. no-cache forces the browser
# to revalidate with the server on every navigation.
# Advertise the existing agent guide, API docs and partial OpenAPI description
# using RFC 8631 relations, so agents can discover the local-node contract
# from a GET or HEAD without parsing the homepage. These are documentation
# links, not a claim that xerj.org hosts a public search API.
# https://www.rfc-editor.org/rfc/rfc8631.html
/
Cache-Control: no-cache
Link: </llms.txt>; rel="describedby"; type="text/plain", </openapi.json>; rel="service-desc"; type="application/json", </docs/agents/endpoints>; rel="service-doc"; type="text/html"
/index.html
Cache-Control: no-cache
Link: </llms.txt>; rel="describedby"; type="text/plain", </openapi.json>; rel="service-desc"; type="application/json", </docs/agents/endpoints>; rel="service-doc"; type="text/html"
# The one-line installer: curl -fsSL https://xerj.org/get | sh
# Serve as plain text so browsers display it (auditable) and curl gets
# a clean script.
#
# NOTE (2026-08-08): /get and /get.ps1 are now answered by the Pages
# Function functions/get.js, which counts the request before serving the
# script body straight out of these same static files (env.ASSETS). The
# Function sets its own Content-Type / Cache-Control / nosniff, because
# _headers rules are not guaranteed to apply to Function responses. The
# two blocks below therefore describe the FALLBACK path — what a client
# gets if the Function is not invoked (Functions disabled, or the route
# dropped from landing/_routes.json). Keep them in sync with the headers
# in functions/get.js.
#
# The Function serves no-store rather than max-age=300: a cached response
# never reaches the origin, so a cache hit is an uncounted install.
/get
Content-Type: text/plain; charset=utf-8
Cache-Control: public, max-age=300
X
5E23
-Robots-Tag: noindex
# Windows installer: powershell -ExecutionPolicy Bypass -c "irm https://xerj.org/get.ps1 | iex"
/get.ps1
Content-Type: text/plain; charset=utf-8
Cache-Control: public, max-age=300
X-Robots-Tag: noindex
# /get.sh alias (#740): text/plain so the Functions-off fallback rewrite to /get
# serves the installer as plain text, never HTML.
/get.sh
Content-Type: text/plain; charset=utf-8
Cache-Control: public, max-age=300
X-Robots-Tag: noindex
# Agent-readable Markdown twins are alternate representations of the HTML
# articles, not HTML pages. Keep the charset explicit for direct fetches.
# X-Robots-Tag: noindex keeps the twin out of the search index while leaving
# it fetchable (HTTP 200, no robots.txt Disallow). Cloudflare Pages applies
# every matching _headers rule and joins a repeated header with a comma;
# these rules are the only X-Robots-Tag on the path, and one `*` splat is
# the documented matcher (https://developers.cloudflare.com/pages/configuration/headers/).
/answers/*.md
Content-Type: text/markdown; charset=utf-8
X-Robots-Tag: noindex
/compare/*.md
Content-Type: text/markdown; charset=utf-8
X-Robots-Tag: noindex
# Demo videos are page assets, not search results of their own. Same reason
# as the installer scripts: fetchable, just not indexed as standalone URLs.
/xerj-biz-demo.mp4
X-Robots-Tag: noindex
/aise-demo.mp4
X-Robots-Tag: noindex
# Public Agent Skills Discovery v0.2.0. Keep the single-file skill's bytes
# unchanged: index.json carries its SHA-256 digest. Revalidate both artifacts
# so clients can detect updates without a long-lived cache of either side.
/.well-known/agent-skills/index.json
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: no-cache, no-transform
/.well-known/agent-skills/xerj/SKILL.md
Content-Type: text/markdown; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: no-cache, no-transform
X-Robots-Tag: noindex