vestige/vercel.json

{
	"$schema": "https://openapi.vercel.sh/vercel.json",
	"framework": null,
	"installCommand": "pnpm install --frozen-lockfile",
	"buildCommand": "VESTIGE_BASE_PATH= VITE_ROOT_REDIRECT=/launch pnpm --filter @vestige/dashboard build",
	"outputDirectory": "apps/dashboard/build",
	"cleanUrls": true,
	"trailingSlash": false,
	"headers": [
		{
			"source": "/_app/immutable/(.*)",
			"headers": [
				{
					"key": "Cache-Control",
					"value": "public, max-age=31536000, immutable"
				}
			]
		},
		{
			"source": "/((?!_app/immutable/).*)",
			"headers": [
				{
					"key": "Cache-Control",
					"value": "public, max-age=0, must-revalidate"
				}
			]
		},
		{
			"source": "/(.*)",
			"headers": [
				{
					"key": "X-Content-Type-Options",
					"value": "nosniff"
				},
				{
					"key": "Referrer-Policy",
					"value": "strict-origin-when-cross-origin"
				},
				{
					"key": "X-Frame-Options",
					"value": "DENY"
				},
				{
					"key": "Strict-Transport-Security",
					"value": "max-age=63072000; includeSubDomains"
				},
				{
					"key": "Permissions-Policy",
					"value": "camera=(), microphone=(), geolocation=()"
				}
			]
		}
	],
	"_csp_note": "CSP TODO: the WebGPU launch page uses SvelteKit inline bootstrap scripts (and likely inline styles); a strict Content-Security-Policy needs nonces/hashes wired through the SvelteKit adapter or it will break the page. Omitting CSP intentionally rather than shipping one that blocks the launch hero. Add later via svelte.config kit.csp once script/style sources are enumerated.",
	"redirects": [
		{
			"source": "/dashboard/launch",
			"destination": "/launch",
			"permanent": false
		},
		{
			"source": "/dashboard/launch/:path*",
			"destination": "/launch",
			"permanent": false
		}
	],
	"rewrites": [
		{
			"source": "/((?!_app/|favicon\\.svg|manifest\\.json|robots\\.txt|.*\\..*).*)",
			"destination": "/200.html"
		}
	]
}