From 7d0c1f82d571b2a48cb6bea94bff800f9af5813b Mon Sep 17 00:00:00 2001
From: thePR0M3TH3AN <53631862+PR0M3TH3AN@users.noreply.github.com>
Date: Tue, 10 Feb 2026 00:51:49 -0500
Subject: [PATCH] Add path-based cache headers for Netlify rollouts

---
 README.md    | 19 +++++++++++++++++++
 _headers     | 21 +++++++++++++++++++++
 netlify.toml | 40 ++++++++++++++++++++++++++++++++++++++++
 3 files changed, 80 insertions(+)

diff --git a/README.md b/README.md
index 22ff1227..f1f14003 100644
--- a/README.md
+++ b/README.md
@@ -337,6 +337,25 @@ The generated `css/tailwind.generated.css` artifact is ignored in git. CI
 workflows and Netlify deploys run `npm run build` to produce the compiled
 stylesheet during deployment, so source changes are all you need to commit.
 
+#### Netlify cache policy for safe fast rollouts
+
+bitvid uses path-class cache rules so deployments propagate quickly without
+breaking long-term static asset caching:
+
+- `index.html`, `embed.html`, and other `*.html` shell pages are served with
+  `Cache-Control: no-cache, must-revalidate` so clients always revalidate the
+  app entry document before booting a new session.
+- Hashed bundles under `/css/*` and `/js/*` are served with
+  `Cache-Control: public, max-age=31536000, immutable` so browsers and CDNs can
+  keep them for a year with zero revalidation churn.
+- Service-worker-related files (`/sw.min.js`, `/site.webmanifest`) use short,
+  revalidation-friendly cache controls (`max-age=0, must-revalidate`) so rollout
+  metadata and worker updates are picked up promptly.
+
+This split is required for safe fast rollouts: HTML needs rapid update pickup,
+while fingerprinted static assets should remain aggressively cacheable for
+performance and cost control.
+
 Inline styles are intentionally blocked. `npm run lint:inline-styles` scans HTML
 and scripts for `style=` attributes, `element.style`, or `style.cssText` usage
 and will fail CI until offending markup is moved into the shared CSS/token
diff --git a/_headers b/_headers
index 4ac92a4d..28570d6b 100644
--- a/_headers
+++ b/_headers
@@ -1,2 +1,23 @@
 /*
   Content-Security-Policy: frame-ancestors *
+
+/index.html
+  Cache-Control: no-cache, must-revalidate
+
+/embed.html
+  Cache-Control: no-cache, must-revalidate
+
+/*.html
+  Cache-Control: no-cache, must-revalidate
+
+/css/*
+  Cache-Control: public, max-age=31536000, immutable
+
+/js/*
+  Cache-Control: public, max-age=31536000, immutable
+
+/sw.min.js
+  Cache-Control: public, max-age=0, must-revalidate
+
+/site.webmanifest
+  Cache-Control: public, max-age=0, must-revalidate
diff --git a/netlify.toml b/netlify.toml
index eca58593..4302d16e 100644
--- a/netlify.toml
+++ b/netlify.toml
@@ -4,3 +4,43 @@
 
 [build.environment]
   NODE_ENV = "development"
+
+[[headers]]
+  for = "/*"
+  [headers.values]
+    Content-Security-Policy = "frame-ancestors *"
+
+[[headers]]
+  for = "/index.html"
+  [headers.values]
+    Cache-Control = "no-cache, must-revalidate"
+
+[[headers]]
+  for = "/embed.html"
+  [headers.values]
+    Cache-Control = "no-cache, must-revalidate"
+
+[[headers]]
+  for = "/*.html"
+  [headers.values]
+    Cache-Control = "no-cache, must-revalidate"
+
+[[headers]]
+  for = "/css/*"
+  [headers.values]
+    Cache-Control = "public, max-age=31536000, immutable"
+
+[[headers]]
+  for = "/js/*"
+  [headers.values]
+    Cache-Control = "public, max-age=31536000, immutable"
+
+[[headers]]
+  for = "/sw.min.js"
+  [headers.values]
+    Cache-Control = "public, max-age=0, must-revalidate"
+
+[[headers]]
+  for = "/site.webmanifest"
+  [headers.values]
+    Cache-Control = "public, max-age=0, must-revalidate"