_headers

# Cloudflare Pages reads a single _headers file at the deployment root.
#
# IMPORTANT — how Cloudflare merges rules (this is why the file is shaped this way):
#   * An incoming request inherits the headers of EVERY rule whose pattern matches.
#   * If the SAME header name is set by two matching rules, the values are COMMA-JOINED,
#     not overridden. For Content-Security-Policy that means the browser enforces BOTH
#     policies as an intersection (a resource must pass every policy), and for
#     Permissions-Policy the last-declared value of a key wins.
#   * There is NO "more specific path wins" behaviour. Order/specificity do not override.
#
# Consequence: we must never set a RESTRICTIVE Content-Security-Policy or Permissions-Policy
# on `/*`, or it would merge into every tool page and nullify that tool's connect-src /
# media-src / capability grants. So:
#   - `/*` carries ONLY the four static headers that are identical on every path.
#   - Every HTML path declares its OWN CSP + Permissions-Policy (single-source per header).
#   - Guide pages also match their parent tool rule, so their CSP is the (safe) intersection
#     of "parent + strict" = strict. That is intentional and correct.
#
# When adding a new HTML page, give it its own block below. When adding a tool that needs a
# remote/loopback origin, put it in that tool's connect-src only, never on `/*`.
#
# Tradeoff: any path with NO block here inherits only the four static headers and no CSP -
# including the 404 body served at unknown URLs, and any future page someone forgets to list.
# That is acceptable (those pages load no scripts and no external resources, and still carry
# nosniff / X-Frame-Options / HSTS), but give every real content page its own block above.
#
# Validate with: python3 scripts/check_csp.py   (run in CI by .github/workflows/quality.yml)

# --- Static headers for every path (identical everywhere, so set once here) --------------
/*
  X-Content-Type-Options: nosniff
  X-Frame-Options: DENY
  Referrer-Policy: no-referrer
  Strict-Transport-Security: max-age=31536000; includeSubDomains

# Shared assets (whitelabel.js) + the tool-template scaffold. /_shared/* matches no
# tool path, so this strict block never merges into a tool's grants. Gives the template
# pages a CSP instead of shipping bare, and is inert on the whitelabel.js subresource.
/_shared/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

# --- Hub + top-level content pages (strict baseline: no network, no device capability) ---
/
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

/index.html
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

/404.html
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

/about/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

# --- Privacy + Accessibility statement pages (static, no network) ------------------------
/privacy/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

/accessibility/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

# --- Full Workstation Checkup: local checks + edge for reachability/latency/clock --------
/checkup/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self' https://edge.desktest.net; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

# The guide is a static doc: no connect-src, so it cannot inherit the edge origin.
/checkup/guide/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

# --- Barcode scanner test: keyboard-wedge capture + optional on-device camera scan --------
/barcode-test/*
  Permissions-Policy: camera=(self), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

/barcode-test/guide/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

# Barcode Test Sheet: printable/scannable code grid; local, no camera (drops the inherited camera grant).
/barcode-test/sheet/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

# --- Touchscreen test: local pointer/touch capture only ----------------------------------
/touch-test/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

/touch-test/guide/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

# --- Call readiness test: camera+mic (getUserMedia) + edge for latency; preview via srcObject --
/call-test/*
  Permissions-Policy: camera=(self), microphone=(self), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self' https://edge.desktest.net; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

/call-test/guide/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

/help/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

# --- Scanner test: FIS WebScan SignalR hub on loopback :58080 ----------------------------
# connect-src keeps both 127.0.0.1 and localhost (both loopback; kept for driver-version
# robustness — some WebScan builds bind one, some the other).
/scanner-test/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self' https://127.0.0.1:58080 wss://127.0.0.1:58080 https://localhost:58080 wss://localhost:58080; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

/scanner-test/guide/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

# --- Signature pad test: Topaz SigWeb on loopback :47289/:47290 --------------------------
# img-src adds blob: — SigWebTablet.js renders the captured signature via a blob: URL, and
# without it the <img> load is CSP-blocked and Step 3 hangs forever on a working pad.
# connect-src keeps all loopback + the tablet.sigwebtablet.com DNS alias (resolves to
# 127.0.0.1) because different SigWeb versions use different ones.
/sigpad-test/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; connect-src 'self' https://127.0.0.1:47289 https://127.0.0.1:47290 https://localhost:47289 https://localhost:47290 https://tablet.sigwebtablet.com:47289 https://tablet.sigwebtablet.com:47290; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

/sigpad-test/guide/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

# --- PDF test: renders a same-origin sample.pdf in an <iframe> (frame-src 'self') --------
# frame-ancestors 'self' (not 'none') so the page can frame its own sample.pdf. Because
# frame-ancestors is present, browsers ignore the inherited X-Frame-Options: DENY for these
# paths, so same-origin framing works while cross-origin framing stays blocked. (A per-path
# X-Frame-Options would comma-merge with the /* DENY into an invalid value, so we do NOT set
# one here and rely on frame-ancestors instead.)
/pdf-test/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; frame-src 'self'; base-uri 'self'; form-action 'none'; frame-ancestors 'self'

/pdf-test/guide/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

# --- Printer test: pure browser print, no network --------------------------------------
/printer-test/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

/printer-test/guide/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

# --- SiteLink test: reachability ping to myhub.sitelink.com -----------------------------
/sitelink-test/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self' https://myhub.sitelink.com https://edge.desktest.net; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

/sitelink-test/guide/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

# --- SaaS reachability test: client no-cors pings to vendor hosts + edge second opinion --
/saas-test/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self' https://edge.desktest.net https://outlook.office365.com https://login.microsoftonline.com https://accounts.google.com https://zoom.us https://slack.com https://login.salesforce.com https://www.dropbox.com https://account.docusign.com; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

/saas-test/guide/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

# --- Microphone test: getUserMedia(audio) + blob: playback of the recording -------------
# media-src adds 'self' blob' so the recorded-clip <audio> can play; Permissions-Policy
# enables the mic ONLY on this path (never on /*, which would merge-disable it).
/mic-test/*
  Permissions-Policy: camera=(), microphone=(self), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; media-src 'self' blob:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

/mic-test/guide/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

# --- Webcam test: getUserMedia(video); live preview via srcObject (no media-src needed) --
/webcam-test/*
  Permissions-Policy: camera=(self), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

/webcam-test/guide/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

# --- Speaker test: Web Audio only, no network -------------------------------------------
/speaker-test/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

/speaker-test/guide/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

# --- Keyboard test ----------------------------------------------------------------------
/keyboard-test/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

/keyboard-test/guide/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

# --- System info ------------------------------------------------------------------------
/system-info/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

/system-info/guide/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

# --- Web app readiness: local capability probes only (popups, cookies, notifications, clipboard) --
/webapp-test/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

/webapp-test/guide/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

# --- Performance test: local compute/render/timer benchmarks only ------------------------
/perf-test/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

/perf-test/guide/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

# --- Screen share test: getDisplayMedia; live preview via srcObject (no media-src needed); display-capture is self-allowed by default --
/screenshare-test/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

/screenshare-test/guide/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

# --- Display test -----------------------------------------------------------------------
/display-test/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

/display-test/guide/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

# --- Browser test: feature detection only, no network -----------------------------------
/browser-test/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

/browser-test/guide/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

# --- Network test: public reachability probes + WebSocket echo ---------------------------
/network-test/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self' https://www.cloudflare.com https://www.google.com https://1.1.1.1 https://dns.google https://www.microsoft.com https://edge.desktest.net wss://edge.desktest.net; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

/network-test/guide/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

# --- Email header check: local, sandboxed phishing/spoofing analyzer --------------------
# The input is HOSTILE (pasted phishing email source). This tool makes ZERO network calls:
# everything is local string parsing. Strict baseline CSP with NO connect-src, so the
# browser blocks any network request even if one were somehow attempted. img-src stays
# 'self' data: (no remote images -> no tracking pixels can load from a pasted body).
/email-check/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

/email-check/guide/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

# --- File hash check: local SHA-256/1/512 via Web Crypto, no network --------------------
# The tool reads a chosen/dropped file and hashes it with crypto.subtle entirely in the
# browser. ZERO network calls, so a strict baseline CSP with NO connect-src: the browser
# blocks any request even if one were somehow attempted. img-src stays 'self' data:.
/hash-check/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

/hash-check/guide/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

# --- Certificate inspector: local X.509 parser, ZERO network ----------------------------
# The input is UNTRUSTED (a hostile certificate can carry attacker strings in CN / O / SAN).
# This tool makes ZERO network calls: the certificate is parsed by a hand-written DER walker
# in the browser. Strict baseline CSP with NO connect-src, so the browser blocks any network
# request even if one were somehow attempted. img-src stays 'self' data:.
/cert-check/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

/cert-check/guide/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

# --- Proxy test: single edge-reflector fetch to detect a proxy / TLS inspection ----------
/proxy-test/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self' https://edge.desktest.net; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

/proxy-test/guide/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

# --- Clock test: trusted edge time (NTP-lite) offset measurement ------------------------
/clock-test/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self' https://edge.desktest.net; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

/clock-test/guide/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

# --- USB device test: WebUSB / WebHID chooser, no network -------------------------------
/usb-test/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

/usb-test/guide/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

# --- Mouse test: Pointer/wheel events, no network ---------------------------------------
/mouse-test/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

/mouse-test/guide/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

# --- WebRTC test: RTCPeerConnection + public STUN (STUN is not governed by connect-src) --
/webrtc-test/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self' https://edge.desktest.net; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

/webrtc-test/guide/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

# --- Build-now batch: keylayout, device-sanity, socket-stability, font-check, camera-quality, access-check ---

# Keyboard Layout Test: fully local (which character each physical key produces).
/keylayout-test/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

/keylayout-test/guide/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

# Device Selection Check: local getUserMedia (camera+mic) for device/in-use/level; no network.
/device-sanity/*
  Permissions-Policy: camera=(self), microphone=(self), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

/device-sanity/guide/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

# Connection Stability Test: sustained WebSocket to the edge echo.
/socket-stability-test/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self' https://edge.desktest.net wss://edge.desktest.net; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

/socket-stability-test/guide/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

# Font Presence Check: fully local (canvas measureText, document.fonts, opt-in queryLocalFonts).
/font-check/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

/font-check/guide/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

# Camera Quality Check: local camera capture + in-tab frame analysis; no network.
/camera-quality/*
  Permissions-Policy: camera=(self), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

/camera-quality/guide/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

# Accessibility and Zoom Check: fully local (matchMedia / visualViewport / DPR readout).
/access-check/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

/access-check/guide/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

# --- Batch 2: speed, currency, echo, kiosk, serial, card-reader -------------------------

# Speed Test: download/upload throughput against the edge (random filler, discarded).
/speed-test/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self' https://edge.desktest.net; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

/speed-test/guide/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

# Browser and OS Currency Check: fully local (inline version baseline + UA-CH readout).
/currency-test/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

/currency-test/guide/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

# Echo and Latency Test: local mic + Web Audio; no network.
/echo-test/*
  Permissions-Policy: camera=(), microphone=(self), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

/echo-test/guide/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

# Kiosk Readiness Check: local; needs fullscreen / wake-lock / idle-detection grants.
/kiosk-test/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=(), fullscreen=(self), screen-wake-lock=(self), idle-detection=(self)
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

/kiosk-test/guide/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=(), fullscreen=(), screen-wake-lock=(), idle-detection=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

# Serial Peripheral Test: local Web Serial; needs the serial grant.
/serial-test/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=(), serial=(self)
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

/serial-test/guide/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=(), serial=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

# Card Reader Test: fully local keyboard-wedge; card data never leaves the tab, nothing stored.
/card-reader-test/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

/card-reader-test/guide/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

# --- Batch 3: Security Key Test (WebAuthn) ----------------------------------------------

/security-key-test/*
  Permissions-Policy: publickey-credentials-create=(self), publickey-credentials-get=(self), camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

/security-key-test/guide/*
  Permissions-Policy: publickey-credentials-create=(), publickey-credentials-get=(), camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

# --- Batch 4: notification, controller, clipboard, cache (grid-fillers) ------------------

# Notification Test: local (requests permission + fires a test notification); no network.
/notification-test/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

/notification-test/guide/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

# Controller Test: local Gamepad API; needs the gamepad grant.
/controller-test/*
  Permissions-Policy: gamepad=(self), camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

/controller-test/guide/*
  Permissions-Policy: gamepad=(), camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

# Clipboard Test: local copy/paste; needs clipboard read/write grants.
/clipboard-test/*
  Permissions-Policy: clipboard-read=(self), clipboard-write=(self), camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

/clipboard-test/guide/*
  Permissions-Policy: clipboard-read=(), clipboard-write=(), camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

# Cache and Update Test: fully local (read-only service-worker / cache / storage inspection).
/cache-test/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

/cache-test/guide/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

# --- Phase 1 flagship flows: connection-check, meeting-check, station-check, phone-check ---

# Connection Check: layered "whose fault" verdict; edge reachability/soak/bandwidth/reach/time.
/connection-check/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self' https://edge.desktest.net wss://edge.desktest.net; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

/connection-check/guide/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

# Meeting Readiness: A/V + call-grade network; getUserMedia camera+mic; ?mode presets.
/meeting-check/*
  Permissions-Policy: camera=(self), microphone=(self), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self' https://edge.desktest.net wss://edge.desktest.net; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

/meeting-check/guide/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

# Front-Desk Station Check: strict-local guided checklist (links out; no network on this page).
/station-check/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

/station-check/guide/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

# Phone Check: mobile device flow; camera/mic + motion sensors; edge reachability.
/phone-check/*
  Permissions-Policy: camera=(self), microphone=(self), accelerometer=(self), gyroscope=(self), magnetometer=(self), ambient-light-sensor=(self), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self' https://edge.desktest.net; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

/phone-check/guide/*
  Permissions-Policy: camera=(), microphone=(), accelerometer=(), gyroscope=(), magnetometer=(), ambient-light-sensor=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

# --- Phase 2: refresh-rate, pen-test, recording-check (all strict-local) -----------------

/refresh-rate/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

/refresh-rate/guide/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

/pen-test/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

/pen-test/guide/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

# Recording Quality Check: local mic capture only (no playback, no network).
/recording-check/*
  Permissions-Policy: camera=(), microphone=(self), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

/recording-check/guide/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

# Display Check: guided full-screen visual grading suite; strict-local, no network.
/display-check/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

/display-check/guide/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

# --- Connectivity: bluetooth (Web Bluetooth), nfc (Web NFC, Android), midi (Web MIDI) ---

/bluetooth-test/*
  Permissions-Policy: bluetooth=(self), camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

/bluetooth-test/guide/*
  Permissions-Policy: bluetooth=(), camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

# NFC: do NOT add nfc=() - that would disable Web NFC. Standard block leaves it working on Android.
/nfc-test/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

/nfc-test/guide/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

/midi-test/*
  Permissions-Policy: midi=(self), camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'

/midi-test/guide/*
  Permissions-Policy: midi=(), camera=(), microphone=(), geolocation=(), interest-cohort=()
  Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; form-action 'none'; frame-ancestors 'none'