rastrillo / fiesta Public

Write a _headers file that caches releases for a year and /M/ for minutes

Every file fiesta.rastrillo.org serves goes out with CARLOS's default
Cache-Control: no-cache, so every page on every site that links
/1.0.0/fiesta.css revalidates it on every view, for bytes that cannot
change. CARLOS v0.31.1 reads a _headers file at the root of a static
tree, and site.Build now writes one beside _redirects, from the same
inputs, so cutting a release adds its own rule.

/M/* gets five minutes, not a year: the edge matches the address the
browser asked for, before the /M/ rewrite, and /1/ moves to each new
1.x. Each release's /M.y.z/* gets a year and immutable. Both carry
Access-Control-Allow-Origin: * and Cross-Origin-Resource-Policy:
cross-origin, so other sites can fetch the strings, load modules and
pin files by hash. The gallery's hashed assets get a year and
immutable alone; only the gallery loads them. Everything else keeps
no-cache, so a deploy shows on the next load.

The hashed assets are found by gallery.Fingerprinted, which lists a
hashed name only when its plain twin is beside it with the same bytes.
A regexp on the name was rejected: a name that merely looks hashed
could take other bytes later, and a browser told it never changes
would keep the old ones. www.Rules hands both the redirects and these
addresses to site.Build, which now takes a Rules value in place of the
variadic redirects, so the three callers cannot keep one and drop the
other.

Build refuses what carlos ship would refuse, so it fails on the
branch and not on the day the site ships: a header outside the five
the edge allows, or a value it refuses (headers are constants, so
this fires only when someone edits them), a line over 2,048
characters, and more than 90 paths, ten short of the edge's 100, with
what to do. An immutable address must be a page, spelled so the edge
reads it as that page's path. A page named _headers is refused, as
_redirects is.

With a path per major and per release, _headers stops a site at 45
majors, so the _redirects test that built 2,000 majors now reaches
2,000 rules through the pages' rules instead.

internal/www's tests read the built file with a mirror of the edge's
parser and hold it to exactly its rules, immutability exactly on
releases and hashed assets, every rule matching a built file, and the
edge's limits.

Red: each new test failed by assertion against a Build that wrote no
_headers and a Fingerprinted that listed nothing. Mutations, each red
and reverted: releases cached five minutes; /M/ cached a year; plain
assets listed; any hashed-looking name listed; www.Rules dropping the
immutable addresses; the stop at 100; any origin accepted; any header
name accepted; no line limit; an immutable address not checked
against the pages; cross-origin headers on the hashed assets.

Add a CARLOS `_headers` file to Fiesta's built site, on branch fiesta-1-1, so that 1.1 ships with it.

Background. CARLOS v0.31.1, live on the flagship, lets a static site ship a `_headers` file at the root of its tree, beside `_redirects`. Rules match the path the browser asked for, before any rewrite; every matching rule applies, and the last one wins per header. Only five headers are allowed: Cache-Control; Access-Control-Allow-Origin, `*` only; Access-Control-Expose-Headers; Cross-Origin-Resource-Policy; Timing-Allow-Origin. A file can have at most 100 paths and 2,048 characters a line. A matching Cache-Control replaces the default `no-cache`.

What to generate. internal/site/site.go writes `_redirects` today; generate `_headers` the same way, from the releases that are built, so a new release adds its own rule.
1. Each published version, `/<x.y.z>/*`: `Cache-Control: public, max-age=31536000, immutable`, `Access-Control-Allow-Origin: *` and `Cross-Origin-Resource-Policy: cross-origin`.
2. `/1/*`, and every other major the site serves the same way: `Cache-Control: public, max-age=300`, plus the same two cross-origin headers. `/1/` is rewritten to the newest 1.x, so it must stay short-lived.
3. The gallery's fingerprinted assets, the files named `name.<16 hex>.ext` under /design-system/assets/: `Cache-Control: public, max-age=31536000, immutable`. List each path exactly. They need no CORS.
4. Everything else (HTML, `/static/*`, the unfingerprinted copies) gets no rule, so the platform's `no-cache` default stays.
Order general rules before specific ones. Write short `#` comments in the file that say why.

Limits. The builder must fail the build, with a message, if the file would break CARLOS's limits. It must also fail if it would set a header outside the allowed five. Stop at 90 paths with a message saying what to do.

Tests, red first. The built `_headers` has exactly the rules above. Every fingerprinted file in the built tree has an immutable rule, and nothing unfingerprinted does. Every rule's path matches at least one built file. The build refuses an oversized file or a disallowed header.

If an internal/www test serves the built site the way the edge does, decide whether it should apply `_headers` too. If it can be done cheaply, add an assertion that a request for `/1/fiesta.css` would get `max-age=300` and not immutable, since rules match before the rewrite.

site.Build writes _headers from the releases and the gallery's hashed assets, refusing what CARLOS's edge would refuse.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>