# Apache / LiteSpeed (typical for cPanel/DirectAdmin shared hosting)
Options -Indexes
# "/" must serve the PWA shell, not the API front controller (many hosts list index.php first).
DirectoryIndex index.html

<IfModule mod_rewrite.c>
  RewriteEngine On

  # Force HTTPS (Service Worker and secure cookies require it)
  RewriteCond %{HTTPS} !=on
  RewriteCond %{HTTP:X-Forwarded-Proto} !=https
  RewriteCond %{HTTP_HOST} !^localhost [NC]
  RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

  # API -> front controller
  RewriteRule ^api/ index.php [L,QSA]
</IfModule>

<IfModule mod_headers.c>
  Header always set X-Content-Type-Options "nosniff"
  Header always set Referrer-Policy "same-origin"
  Header always set X-Frame-Options "DENY"
  Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; font-src 'self'; connect-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'"
  # The service worker must always be revalidated so updates reach the POS.
  <FilesMatch "^(sw\.js|index\.html)$">
    Header set Cache-Control "no-cache"
  </FilesMatch>
</IfModule>

<IfModule mod_mime.c>
  AddType application/manifest+json .webmanifest
  AddType text/javascript .js .mjs
</IfModule>

# Remove the hosting check script after the host has been verified.
# <Files "env-check.php">
#   Require all denied
# </Files>
