vadra.checkoutaibusiness.com {
  encode zstd gzip

  header {
    Strict-Transport-Security "max-age=31536000; includeSubDomains"
    X-Content-Type-Options "nosniff"
    Referrer-Policy "strict-origin-when-cross-origin"
    Permissions-Policy "camera=(), microphone=(), geolocation=()"
    -Server
  }

  # Anonymous preview is an explicit presentation-only allowlist. No API or
  # local-product route is exposed, even if a backend is accidentally started.
  @preview {
    method GET HEAD
    path / /demo /help /roadmap /_next/static/* /icons/* /manifest.webmanifest /sw.js /favicon.ico
  }
  handle @preview {
    # Resolve the public entry before rendering the local product shell.
    redir / /demo 302
    reverse_proxy 127.0.0.1:3100
  }
  handle {
    respond "VADRA public preview is read-only. Local operations are unavailable." 403
  }
}
