From efb60eddc80fee7c1431b7c4095cf8edebf0ba13 Mon Sep 17 00:00:00 2001
From: Jamie <truegoodcraft@gmail.com>
Date: Tue, 15 Sep 2026 17:15:58 -0400
Subject: [PATCH] Prevent host rewriting on project site

---
 scripts/build-project.ts             | 3 ++-
 tests/contracts/project-site.test.ts | 1 +
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/scripts/build-project.ts b/scripts/build-project.ts
index 465554a..addd291 100644
--- a/scripts/build-project.ts
+++ b/scripts/build-project.ts
@@ -32,7 +32,8 @@ function projectHeaders(html: string, production: boolean): Record<string, strin
     'X-Frame-Options': 'DENY',
     'Permissions-Policy': 'geolocation=(), camera=(), microphone=(), payment=()',
     ...(production ? { 'Strict-Transport-Security': 'max-age=31536000' } : {}),
-    'Cache-Control': 'no-cache'
+    // Keep the host from rewriting mail links or injecting client scripts into this static artifact.
+    'Cache-Control': 'no-cache, no-transform'
   };
 }
 
diff --git a/tests/contracts/project-site.test.ts b/tests/contracts/project-site.test.ts
index ed2c0dd..04d7349 100644
--- a/tests/contracts/project-site.test.ts
+++ b/tests/contracts/project-site.test.ts
@@ -32,6 +32,7 @@ test('preview and production discovery policies stay distinct and aliases remain
   assert.equal((await readFile(path.join(targets.preview, 'sitemap.xml'), 'utf8')).includes('<url>'), false);
   assert.equal((await readFile(path.join(targets.production, 'sitemap.xml'), 'utf8')).match(/<loc>/g)?.length, 1);
   const headers = await readFile(path.join(targets.production, '_headers'), 'utf8');
+  assert.equal(responseHeaders(headers, new URL('https://food-help.ca/'))['Cache-Control'], 'no-cache, no-transform');
   assert.equal(responseHeaders(headers, new URL('https://food-help.ca/'))['X-Robots-Tag'], undefined);
   assert.equal(responseHeaders(headers, new URL('https://project.pages.dev/'))['X-Robots-Tag'], 'noindex');
   assert.equal(responseHeaders(headers, new URL('https://review.project.pages.dev/'))['X-Robots-Tag'], 'noindex');