# Ensure the PWA manifest is served with the correct MIME type.
AddType application/manifest+json .webmanifest

# Never serve config.php over HTTP (defense in depth — deploy.sh already excludes it).
<Files "config.php">
    Require all denied
</Files>

# The service worker must never be served from a stale browser cache, or an
# update to it can take days to reach an installed app.
<IfModule mod_headers.c>
    <Files "sw.js">
        Header set Cache-Control "no-cache, max-age=0, must-revalidate"
    </Files>
</IfModule>

# Neither the config template nor the migrations belong in the web root, but
# deny them too in case they are copied there by accident.
<FilesMatch "^(config\.sample\.php|.*\.sql)$">
    Require all denied
</FilesMatch>