import adapter from '@sveltejs/adapter-node';

/** @type {import('@sveltejs/kit').Config} */
const config = {
	compilerOptions: {
		runes: true
	},
	kit: {
		adapter: adapter(),
		// Content-Security-Policy — the highest-value header for this UGC app and the
		// cheapest hardening of the localStorage-based auth (the whole model rests on
		// never having an XSS). `mode: 'auto'` lets SvelteKit nonce/hash its own inline
		// hydration script, so script-src stays free of 'unsafe-inline'.
		csp: {
			mode: 'auto',
			directives: {
				'default-src': ['self'],
				'script-src': ['self'],
				// Svelte emits inline style attributes (style: directives); allow them.
				'style-src': ['self', 'unsafe-inline'],
				'img-src': ['self', 'data:', 'blob:'],
				'media-src': ['self', 'blob:'],
				'font-src': ['self'],
				'connect-src': ['self'],
				'object-src': ['none'],
				'base-uri': ['self'],
				'form-action': ['self'],
				'frame-ancestors': ['none']
			}
		}
	}
};

export default config;