import adapter from '@sveltejs/adapter-node';
import { vitePreprocess } from '@sveltejs/vite-plugin-svelte';
import { THEME_SCRIPT_HASH } from './csp-config.js';

/** @type {import('@sveltejs/kit').Config} */
const config = {
    preprocess: vitePreprocess(),
    kit: {
        adapter: adapter({ out: 'build' }),
        // Content-Security-Policy. `mode: 'hash'` makes SvelteKit hash the
        // inline scripts IT injects (the hydration bootstrap) and append those
        // hashes to `script-src`. It does NOT hash the theme <script> in
        // app.html — that template script isn't part of `%sveltekit.head%`, so
        // we pin its sha256 here by hand (THEME_SCRIPT_HASH). If that script is
        // edited, the hash drifts and the theme-flash guard would be silently
        // CSP-blocked; `svelte.config.test.js` recomputes the hash from
        // app.html and fails if it no longer matches this constant.
        // Styles are left unconstrained (Svelte emits dynamic inline `style=`
        // attributes); this policy is clickjacking + script-injection defense
        // in depth, not a full lockdown. The non-CSP defense-in-depth headers
        // (X-Frame-Options, Referrer-Policy, Permissions-Policy) live in
        // hooks.server.ts.
        csp: {
            mode: 'hash',
            directives: {
                'script-src': ['self', THEME_SCRIPT_HASH],
                'object-src': ['none'],
                'base-uri': ['self'],
                'frame-ancestors': ['none']
            }
        }
    }
};

export default config;