netlify.toml

# Serve WASM with correct MIME and long cache (match nested paths)
[[headers]]
  for = "/assets/**/*.wasm"
  [headers.values]
    Content-Type = "application/wasm"
    Cache-Control = "public, max-age=31536000, immutable"

# JS files (match nested paths)
[[headers]]
  for = "/assets/**/*.js"
  [headers.values]
    Content-Type = "application/javascript"
    Cache-Control = "public, max-age=31536000, immutable"

# Static assets (images, fonts, etc.)
[[headers]]
  for = "/assets/**"
  [headers.values]
    Cache-Control = "public, max-age=31536000, immutable"

# Keep HTML non-aggressively cached (so index.html always fetches latest manifest)
[[headers]]
  for = "/**/*.html"
  [headers.values]
    Cache-Control = "no-cache"

# Optional security headers
[[headers]]
  for = "/*"
  [headers.values]
    X-Frame-Options = "DENY"
    Referrer-Policy = "no-referrer-when-downgrade"
    X-Content-Type-Options = "nosniff"
    Strict-Transport-Security = "max-age=63072000; includeSubDomains; preload"

# SPA fallback — static files are served first; only unmatched routes go to index.html
[[redirects]]
  from = "/*"
  to = "/index.html"
  status = 200
  force = false

# Example for precompressed WASM (only if you actually upload .wasm.br/.wasm.gz)
# [[headers]]
#   for = "/**/*.wasm.br"
#   [headers.values]
#     Content-Type = "application/wasm"
#     Content-Encoding = "br"