Options -Indexes
RewriteEngine On
# Keep internal verification reports out of public-facing pages.
RewriteRule ^(?:delivery-report\.json|synth-tests\.json)$ - [F,END,NC]
# Older source download links lead to the current source package.
RewriteRule ^downloads/MarTrack-0\.2\.0-alpha\.5-Web-source\.zip(\.sha256)?$ /MarTrack/downloads/MarTrack-0.2.0-alpha.6-Synth-source.zip$1 [R=302,L]
# Development notes and historical candidate builds are private, including direct URLs.
RewriteRule ^(?:README\.md|WORKSTATION\.md|QA\.md|retro-targets\.html|(?:polyphony|workstation)-tests\.json|_poly-candidate(?:/|$)) - [F,END,NC]
RewriteRule ^downloads/.*(?:studio-source|MED-source|Workstation-source|Polyphony-source|complete)\.zip(?:\.sha256)?$ - [F,END,NC]
<FilesMatch "(?i)(?:\.bak(?:[-.]|$)|\.tmp$)">
  Require all denied
</FilesMatch>
DirectoryIndex index.html
AddType application/wasm .wasm
# UTF-8 Markdown must declare its charset; do not rely on browser guessing.
AddCharset UTF-8 .md .markdown
<IfModule mod_headers.c>
  Header always unset Permissions-Policy
  Header always set Permissions-Policy "camera=(), microphone=(self), midi=(self), geolocation=()"
  Header always set X-Content-Type-Options "nosniff"
  Header always set Referrer-Policy "same-origin"
  Header always set Content-Security-Policy "default-src 'self'; script-src 'self' 'wasm-unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; media-src 'self' blob:; worker-src 'self' blob:; connect-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'; form-action 'none'"
  <FilesMatch "(?i)\.(html|js|css|md|markdown)$">
    Header set Cache-Control "no-cache"
  </FilesMatch>
</IfModule>
