<?php

declare(strict_types=1);

// 1. Configuration
require_once __DIR__ . '/../config/config.php';

// 2. Autoloader
require_once __DIR__ . '/Autoloader.php';

// 2b. Composer autoloader (PhpSpreadsheet etc.)
if (file_exists(BASE_PATH . '/vendor/autoload.php')) {
    require_once BASE_PATH . '/vendor/autoload.php';
}

// 3. Helper functions
require_once BASE_PATH . '/app/Helpers/Helpers.php';

// 4. Start session
\Core\Session::start();

// 5. Security headers
header('X-Frame-Options: SAMEORIGIN');
header('X-Content-Type-Options: nosniff');
header('X-XSS-Protection: 1; mode=block');
header('Referrer-Policy: strict-origin-when-cross-origin');
if (!APP_DEBUG) {
    header('Content-Security-Policy: default-src \'self\'; script-src \'self\' \'unsafe-inline\' cdn.jsdelivr.net; style-src \'self\' \'unsafe-inline\' cdn.jsdelivr.net fonts.googleapis.com; font-src \'self\' fonts.gstatic.com cdn.jsdelivr.net; img-src \'self\' data: placehold.co;');
}
