# ── Redirigir HTTP → HTTPS ────────────────────────────────────────────────────
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

# ── SPA: redirigir todas las rutas a index.html ───────────────────────────────
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.html [L]

# ── Security headers ──────────────────────────────────────────────────────────
<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
    Header always set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: blob:; media-src 'self' blob:; connect-src 'self' https://api.emailjs.com https://fonts.googleapis.com; frame-src https://www.google.com/maps/ https://maps.google.com; object-src 'none'; base-uri 'self'; form-action 'self';"
</IfModule>

# ── Compresión Gzip ───────────────────────────────────────────────────────────
<IfModule mod_deflate.c>
    AddOutputFilterByType DEFLATE text/html text/css application/javascript application/json image/svg+xml font/woff2
</IfModule>

# ── Cache del navegador ───────────────────────────────────────────────────────
<IfModule mod_expires.c>
    ExpiresActive On

    # Assets con hash en el nombre (Vite los genera automáticamente) — 1 año
    <FilesMatch "\.(js|css|woff2?|png|jpg|jpeg|svg|gif|webp|ico|mp4|pdf)$">
        ExpiresDefault "access plus 1 year"
        Header append Cache-Control "public, immutable"
    </FilesMatch>

    # HTML nunca en cache para que los cambios se vean de inmediato
    <FilesMatch "\.html$">
        ExpiresDefault "access plus 0 seconds"
        Header set Cache-Control "no-cache, no-store, must-revalidate"
    </FilesMatch>
</IfModule>
