XML Style

server.js

@@ -19,6 +19,13 @@ const PAGE_SIZE_MAX = 48;
 const UPLOAD_MAX_BYTES = 5 * 1024 * 1024;
 const REQUEST_MAX_BYTES = 6 * 1024 * 1024;
 const events = new Set();
+const DISCOVERY_ROUTES = new Set([
+  '/robots.txt',
+  '/llms.txt',
+  '/site.webmanifest',
+  '/feed.json',
+  '/sitemap.xml'
+]);
 const ADMIN_TOKEN = process.env.ADMIN_TOKEN || crypto.randomBytes(24).toString('hex');
 const indexTemplate = await fs.readFile('./public/index.html', 'utf8');
 
@@ -32,10 +39,9 @@ if (!process.env.ADMIN_TOKEN) {
 }
 
 const server = http.createServer(async (req, res) => {
-  withSecurityHeaders(res);
-
   try {
     const url = new URL(req.url || '/', `http://${req.headers.host || 'localhost'}`);
+    withSecurityHeaders(res, { contentSecurityPolicy: !isDiscoveryRoute(req, url) });
     const baseUrl = publicBaseUrl(req);
 
     if (req.method === 'GET' && url.pathname === '/') {
@@ -253,6 +259,11 @@ function positiveInt(value, fallback) {
   return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;
 }
 
+function isDiscoveryRoute(req, url) {
+  if (req.method !== 'GET') return false;
+  return DISCOVERY_ROUTES.has(url.pathname);
+}
+
 function downloadName(meme) {
   return `meme-protocol-${meme.id.slice(0, 12)}.${meme.ext}`;
 }