# KAI API Server — Root .htaccess

# ── MIME Types ───────────────────────────────────────────────
<IfModule mod_mime.c>
    AddType text/css                  .css
    AddType application/javascript    .js
    AddType application/json          .json
</IfModule>

# Block direct browser access to sensitive files
<FilesMatch "^(config|bootstrap)\.php$">
    Order deny,allow
    Deny from all
</FilesMatch>

# Block access to logs folder
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteRule ^logs/ - [F,L]
</IfModule>

# Security headers
<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "DENY"
    Header always set X-XSS-Protection "1; mode=block"
</IfModule>

# ── Cache-busting strategy ───────────────────────────────────
# The widget assets (embed.css, kai-standalone.js) are loaded with a ?v=
# version query by embed.js, so they can be cached hard — the query string
# changes on every deploy and forces a fresh fetch. But embed.js itself is
# the loader that carries the version number, so it must NEVER be cached
# stale — it's served no-cache so every visitor always gets the latest
# version stamp, which then pulls the matching CSS/JS. Result: deploy once,
# every user (new and returning) sees the new version automatically.
<IfModule mod_headers.c>
    # Hard-cache versioned static assets (busted via ?v= query)
    <FilesMatch "\.(css|js)$">
        Header set Cache-Control "public, max-age=31536000, immutable"
    </FilesMatch>
    # …except the loader — always revalidate so version bumps propagate
    <FilesMatch "^embed\.js$">
        Header set Cache-Control "no-cache, no-store, must-revalidate, max-age=0"
        Header set Pragma "no-cache"
        Header set Expires "0"
    </FilesMatch>
</IfModule>
