# Headers para Cloudflare Pages
# sw.js no debe cachearse para que el navegador detecte updates inmediatamente
/dashboard/sw.js
  Cache-Control: no-cache, no-store, must-revalidate

# El HTML principal tampoco debe cachearse (el SW maneja el cacheo offline)
/dashboard/index.html
  Cache-Control: no-cache, no-store, must-revalidate

/dashboard/
  Cache-Control: no-cache, no-store, must-revalidate

# v2.17.3 — Cabeceras de seguridad globales (hallazgos A8/M15 de la auditoría)
# CSP: la app es 100% inline (sin eval ni iframes externos) → 'unsafe-inline'
# solo para script/style propios; objetos/frames externos bloqueados;
# QR de 2FA (api.qrserver.com) y módulos externos de consumo permitidos.
/*
  X-Frame-Options: DENY
  X-Content-Type-Options: nosniff
  Referrer-Policy: strict-origin-when-cross-origin
  Strict-Transport-Security: max-age=31536000; includeSubDomains
  Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=()
  Cross-Origin-Opener-Policy: same-origin
  Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https://api.qrserver.com; font-src 'self' data:; connect-src 'self' https://panel-operativo.pages.dev https://panel-operativo-mirror.pages.dev https://panel-operativo.dashiellyeneri.workers.dev https://awa3dstd-create.github.io https://consumo-agua.pages.dev https://consumo-gaslp.rafariv44.workers.dev; frame-src 'self' https://consumo-agua.pages.dev https://consumo-gaslp.rafariv44.workers.dev; worker-src 'self'; manifest-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'; form-action 'self'
