firebase.json

{
  "//": "Hosting config for the static export. `npm run build` writes apps/web/out; nothing here is generated, so it is committed.",
  "hosting": {
    "public": "apps/web/out",
    "ignore": ["firebase.json", "**/.*", "**/node_modules/**"],

    "//cleanUrls": "The export emits both admin.html and admin/. Serving /admin from the former keeps URLs free of the extension; Next's own links already assume it.",
    "cleanUrls": true,
    "trailingSlash": false,

    "headers": [
      {
        "//": "Next fingerprints these filenames, so the content behind a URL can never change. The only safe place for a year of immutable caching.",
        "source": "/_next/static/**",
        "headers": [
          { "key": "Cache-Control", "value": "public, max-age=31536000, immutable" }
        ]
      },
      {
        "//": "Chunks and detail sidecars are large and rarely change -- but their filenames are derived from the time bucket, not the content, so a rebuild reuses every name. `immutable` here would serve last month's history for a year. An hour, plus a day of serving stale while revalidating in the background, gets most of the benefit and cannot pin a mistake. See the note below about making these genuinely immutable.",
        "source": "/data/events/**/*.@(bin|json)",
        "headers": [
          {
            "key": "Cache-Control",
            "value": "public, max-age=3600, stale-while-revalidate=86400"
          }
        ]
      },
      {
        "//": "The index files. Everything else is discovered through these, so a stale one hides a whole rebuild -- and they are small enough that revalidating on every load costs a 304.",
        "source": "/data/events/@(manifest|stats|histogram|places).json",
        "headers": [
          { "key": "Cache-Control", "value": "no-cache" }
        ]
      },
      {
        "//": "HTML revalidates so a deploy is visible immediately rather than whenever a cache happens to expire.",
        "source": "**/*.html",
        "headers": [
          { "key": "Cache-Control", "value": "no-cache" }
        ]
      },
      {
        "//": "The data panel is unlisted rather than secret -- it is computed from files in the same deploy -- but it is not what the app is for, so it is told not to appear in results.",
        "source": "/admin{,/**}",
        "headers": [
          { "key": "X-Robots-Tag", "value": "noindex, nofollow" }
        ]
      }
    ]
  }
}