netlify.toml

# Netlify Configuration for Protocol Guide
# PWA deployment with Express API server

[build]
  # Install dependencies and build PWA (landing + Expo web)
  # Note: Server is deployed separately on Railway - not built here
  # Note: pnpm check removed - RN Web has known type mismatches with accessibility props
  # Note: NODE_ENV not set globally - install needs devDeps for NativeWind cache generation
  # Fix NativeWind cache: copy from top-level react-native-css-interop if nested exists without cache
  command = "echo \"[BUILD] node=$(node --version) pnpm=$(pnpm --version)\" && pnpm install && echo \"[BUILD] install ok\" && node scripts/fix-nativewind-cache.js && echo \"[BUILD] nativewind cache ok\" && pnpm build:landing && echo \"[BUILD] landing ok\" && NODE_ENV=production pnpm build:web && echo \"[BUILD] web ok\" && node scripts/integrate-landing.js && echo \"[BUILD] integration ok\" && node scripts/prerender-seo.js && echo \"[BUILD] SEO prerender ok\" && node scripts/prerender-protocol-categories.js && echo \"[BUILD] protocol categories ok\" && node scripts/prerender-comparison-pages.js && echo \"[BUILD] comparison pages ok\" && node scripts/regenerate-sitemaps.js && echo \"[BUILD] sitemaps ok\" && node scripts/inject-ga4.js && echo \"[BUILD] GA4 injection ok\" && node scripts/fix-font-paths.js && echo \"[BUILD] font paths ok\""
  # Expo web export outputs to dist/ by default
  publish = "dist"

[build.environment]
  # Node version for build — 22 is current LTS (Oct 2024), required by Vite 7.x (needs >=20.19 or >=22)
  NODE_VERSION = "22"
  # pnpm version - lockfileVersion 9.0 requires pnpm 9+
  PNPM_VERSION = "9"
  # Do NOT set NODE_ENV=production here - it causes pnpm to skip devDependencies
  # NativeWind's react-native-css-interop needs devDeps to generate .cache/web.css
  # CI = "true" suppresses interactive prompts
  CI = "true"
  # Supabase client-side configuration
  # Set these in Netlify dashboard > Site settings > Environment variables:
  #   EXPO_PUBLIC_SUPABASE_URL
  #   EXPO_PUBLIC_SUPABASE_ANON_KEY
  #   SUPABASE_URL
  #   SUPABASE_ANON_KEY

# API routes proxy to Railway backend
# Must come BEFORE the SPA catch-all redirect
[[redirects]]
  from = "/api/*"
  to = "https://protocol-guide-production.up.railway.app/api/:splat"
  status = 200
  force = false
  [redirects.headers]
    X-Proxy-Target = "railway"

# Legacy URL redirects — /protocols/{state}/{county} → /{state}/{county}/protocols
# 301 redirects from old URL pattern to new prerendered SEO pages
[[edge_functions]]
  path = "/protocols/*"
  function = "legacy-redirects"

# API proxy error handling — return JSON errors instead of Netlify HTML pages
# These fire when Railway returns 502/503 (down or deploying)
[[edge_functions]]
  path = "/api/*"
  function = "api-error-handler"

# Prevent SPA fallback for static asset paths — return 404 instead of HTML
# This prevents cache poisoning: without this, missing .js files get served as
# text/html (app.html) and cached with immutable headers by the browser
[[redirects]]
  from = "/_expo/static/js/web/*.js"
  to = "/404.html"
  status = 404
  force = false

[[redirects]]
  from = "/_expo/static/css/*.css"
  to = "/404.html"
  status = 404
  force = false

# /assets/* rule removed — was blocking font files (MaterialIcons.ttf)
# SPA catch-all with force=false already serves real files correctly

# Redirect /app to home (no matching Expo Router screen)
[[redirects]]
  from = "/app"
  to = "/home"
  status = 302

[[redirects]]
  from = "/app/*"
  to = "/home"
  status = 302

# Legal pages - redirect old settings/* paths to correct root paths
# force = true ensures these redirects take precedence over file-based routing
[[redirects]]
  from = "/settings/terms"
  to = "/terms"
  status = 301
  force = true

[[redirects]]
  from = "/settings/privacy"
  to = "/privacy"
  status = 301
  force = true

[[redirects]]
  from = "/settings/disclaimer"
  to = "/disclaimer"
  status = 301
  force = true

# SPA routing - all non-file paths serve app.html for client-side routing
# Landing page is at /index.html (served by default for /), everything else goes to Expo SPA
[[redirects]]
  from = "/*"
  to = "/app.html"
  status = 200
  # Only redirect if no file exists at path
  force = false

# Security headers for all pages
[[headers]]
  for = "/*"
  [headers.values]
    # HSTS - Force HTTPS for 1 year including subdomains
    Strict-Transport-Security = "max-age=31536000; includeSubDomains; preload"
    # Prevent clickjacking
    X-Frame-Options = "DENY"
    # Prevent MIME type sniffing
    X-Content-Type-Options = "nosniff"
    # XSS protection
    X-XSS-Protection = "1; mode=block"
    # Referrer policy
    Referrer-Policy = "strict-origin-when-cross-origin"
    # Permissions Policy
    Permissions-Policy = "geolocation=(), microphone=(self), camera=(), payment=()"
    # Content Security Policy
    # SECURITY: Configured to prevent XSS while maintaining React Native Web compatibility
    # - Scripts: 'unsafe-inline' required for RN Web runtime (consider migrating to hash-based CSP)
    # - Styles: Uses SHA-256 hash for critical inline styles (more secure than 'unsafe-inline')
    # - Images/Fonts: Restricted to specific trusted domains only
    Content-Security-Policy = """
      default-src 'self';
      script-src 'self' 'unsafe-inline' 'unsafe-eval' https://www.googletagmanager.com https://www.google-analytics.com;
      style-src 'self' 'unsafe-inline' https://fonts.googleapis.com;
      img-src 'self' data: blob: https://*.supabase.co;
      font-src 'self' data: https://fonts.gstatic.com https://fonts.googleapis.com;
      connect-src 'self' https://*.supabase.co https://api.anthropic.com wss://*.supabase.co https://protocol-guide-production.up.railway.app https://api.protocol-guide.com https://fonts.googleapis.com https://www.google-analytics.com https://www.googletagmanager.com https://ingesteer.services-prod.nsvcs.net;
      object-src 'none';
      worker-src 'self';
      frame-ancestors 'none';
      base-uri 'self';
      form-action 'self';
      upgrade-insecure-requests;
    """

# Preconnect to critical origins for faster first-byte
[[headers]]
  for = "/app.html"
  [headers.values]
    Link = '''<https://dflmjilieokjkkqxrmda.supabase.co>; rel=preconnect; crossorigin, <https://fonts.googleapis.com>; rel=preconnect, <https://fonts.gstatic.com>; rel=preconnect; crossorigin'''

# Landing page — preconnect to critical origins
[[headers]]
  for = "/"
  [headers.values]
    Link = '''<https://dflmjilieokjkkqxrmda.supabase.co>; rel=preconnect; crossorigin, <https://fonts.googleapis.com>; rel=preconnect, <https://fonts.gstatic.com>; rel=preconnect; crossorigin'''

# Root-level JS/CSS are NOT content-hashed — use short cache with revalidation.
# NOTE: Netlify applies LATER-matching [[headers]] rules with higher precedence on
# conflicting header keys. This generic rule MUST come BEFORE the specific
# immutable rules below, so that content-hashed bundle paths win the Cache-Control
# contest (prior audit 2026-04-16 showed the generic rule was overriding the
# immutable rule on /_expo/static/js/web/*.js, shipping a 1-hour TTL instead of 1yr).
[[headers]]
  for = "/*.js"
  [headers.values]
    Cache-Control = "public, max-age=3600, stale-while-revalidate=86400"

[[headers]]
  for = "/*.css"
  [headers.values]
    Cache-Control = "public, max-age=3600, stale-while-revalidate=86400"

# Cache content-hashed static assets aggressively (1 year, immutable).
# Defined AFTER the generic rules above so the specific immutable Cache-Control wins.
[[headers]]
  for = "/assets/*"
  [headers.values]
    Cache-Control = "public, max-age=31536000, immutable"

# Expo async route chunks - content-hashed, safe to cache for 1 year
[[headers]]
  for = "/_expo/static/js/web/*.js"
  [headers.values]
    Cache-Control = "public, max-age=31536000, immutable"
    # Enable Core Web Vitals attribution and performance monitoring
    Timing-Allow-Origin = "*"
    # Note: Netlify automatically negotiates Brotli/gzip based on Accept-Encoding.
    # Do NOT set Content-Encoding here — it is a hop-by-hop header managed by the CDN.

# Expo CSS chunks - content-hashed
[[headers]]
  for = "/_expo/static/css/*.css"
  [headers.values]
    Cache-Control = "public, max-age=31536000, immutable"

# Service worker should not be cached long
[[headers]]
  for = "/service-worker.js"
  [headers.values]
    Cache-Control = "public, max-age=0, must-revalidate"

[[headers]]
  for = "/sw.js"
  [headers.values]
    Cache-Control = "public, max-age=0, must-revalidate"

# HTML pages should revalidate
[[headers]]
  for = "/*.html"
  [headers.values]
    Cache-Control = "public, max-age=0, must-revalidate"

# PWA Manifest - correct MIME type and caching
[[headers]]
  for = "/manifest.json"
  [headers.values]
    Content-Type = "application/manifest+json"
    Cache-Control = "public, max-age=0, must-revalidate"
    # Allow cross-origin for PWA installation
    Access-Control-Allow-Origin = "*"

# PWA Icons - cache for 1 year
[[headers]]
  for = "/icon-*.png"
  [headers.values]
    Cache-Control = "public, max-age=31536000, immutable"
    Content-Type = "image/png"

# PWA Screenshots - cache for 1 year (content-hashed filenames not used, but
# screenshots are stable and can be invalidated via manifest update)
[[headers]]
  for = "/screenshot-*.png"
  [headers.values]
    Cache-Control = "public, max-age=31536000, immutable"
    Content-Type = "image/png"

# Offline page - should not be cached long
[[headers]]
  for = "/offline.html"
  [headers.values]
    Cache-Control = "public, max-age=0, must-revalidate"

# Google Fonts CSS - cache with revalidation (font files themselves are on Google CDN)
[[headers]]
  for = "/*.woff2"
  [headers.values]
    Cache-Control = "public, max-age=31536000, immutable"

[[headers]]
  for = "/*.woff"
  [headers.values]
    Cache-Control = "public, max-age=31536000, immutable"

[[headers]]
  for = "/*.ttf"
  [headers.values]
    Cache-Control = "public, max-age=31536000, immutable"
    Content-Type = "font/ttf"

[[headers]]
  for = "/*.otf"
  [headers.values]
    Cache-Control = "public, max-age=31536000, immutable"
    Content-Type = "font/otf"

# Netlify CDN edge cache — cache immutable assets at the edge for 1 year
# This is separate from browser cache and improves TTFB for repeat visitors globally
[[headers]]
  for = "/_expo/static/*"
  [headers.values]
    Netlify-CDN-Cache-Control = "public, max-age=31536000, immutable, durable"

[[headers]]
  for = "/assets/*"
  [headers.values]
    Netlify-CDN-Cache-Control = "public, max-age=31536000, immutable, durable"

# Development settings
[dev]
  command = "pnpm dev:metro"
  port = 8081
  targetPort = 8081
  autoLaunch = false

# Context-specific settings
# NOTE: NODE_ENV is NOT set globally - it's set per-command in the build script
# Setting NODE_ENV=production globally causes devDeps to be skipped during install
# NativeWind requires devDeps (react-native-css-interop) for .cache/web.css generation
[context.production]
  # No NODE_ENV here - build command handles it

[context.deploy-preview]
  # No NODE_ENV here - build command handles it

[context.branch-deploy]
  # No NODE_ENV here - build command handles it

# app.html must never be cached - users need latest chunk references
[[headers]]
  for = "/app.html"
  [headers.values]
    Cache-Control = "no-cache, no-store, must-revalidate"