<!doctype html>
<html lang="en" class="dark">
  <head>
    <meta charset="UTF-8" />
    <meta name="viewport" content="width=device-width, initial-scale=1.0, viewport-fit=cover" />
    <link rel="icon" href="/favicon.svg" type="image/svg+xml" />
    <title>Yawmi</title>
    
    <!-- Security Headers -->
    <!-- Content Security Policy: Strict CSP with nonces for inline scripts/styles -->
    <meta http-equiv="Content-Security-Policy" content="
      default-src 'self';
      script-src 'self' 'unsafe-eval' 'unsafe-inline' https://www.googleapis.com https://www.gstatic.com https://apis.google.com https://securetoken.googleapis.com https://identitytoolkit.googleapis.com https://firebaseapp.com https://*.firebaseapp.com https://storage.googleapis.com https://*.cloudfunctions.net https://www.google.com https://www.recaptcha.net https://js.stripe.com https://*.stripe.com;
      style-src 'self' 'unsafe-inline' https://fonts.googleapis.com;
      font-src 'self' https://fonts.gstatic.com;
      img-src 'self' data: blob: https: http:;
      media-src 'self' blob: data:;
      connect-src 'self' https://firestore.googleapis.com https://firebase.googleapis.com https://firebaseapp.com https://*.firebaseapp.com https://*.googleapis.com https://identitytoolkit.googleapis.com https://securetoken.googleapis.com https://storage.googleapis.com https://*.cloudfunctions.net https://apis.google.com https://www.google.com https://www.recaptcha.net https://api.stripe.com https://m.stripe.com https://m.stripe.network https://*.stripe.com wss:;
      frame-src 'self' https://www.google.com https://www.recaptcha.net https://recaptcha.google.com https://accounts.google.com https://*.firebaseapp.com https://firebaseapp.com https://apis.google.com https://js.stripe.com https://*.stripe.com https://*.stripe.network;
      object-src 'none';
      base-uri 'self';
      form-action 'self';
      upgrade-insecure-requests;
    " />
    
    <!-- Permissions Policy: Disable privacy-sensitive features by default -->
    <meta http-equiv="Permissions-Policy" content="
      camera=(),
      microphone=(),
      geolocation=(),
      payment=(),
      usb=(),
      magnetometer=(),
      gyroscope=(),
      accelerometer=(),
      ambient-light-sensor=(),
      autoplay=(self),
      encrypted-media=(self),
      fullscreen=(self),
      picture-in-picture=(self)
    " />
    
    <!-- Referrer Policy: Strict origin when cross-origin -->
    <meta name="referrer" content="strict-origin-when-cross-origin" />
    
    <!-- Prevent MIME type sniffing -->
    <meta http-equiv="X-Content-Type-Options" content="nosniff" />
    
    <!-- Enable XSS Protection -->
    <meta http-equiv="X-XSS-Protection" content="1; mode=block" />
    
    <!-- Frame embedding prevention handled by CSP frame-src 'none' above -->
    
    <!-- DNS Prefetch Control -->
    <meta http-equiv="X-DNS-Prefetch-Control" content="on" />
    
    <!-- Default Meta Tags (will be overridden by prerender for crawlers) -->
    <meta name="title" content="Yawmi - Share Your Story" />
    <meta name="description" content="Create beautiful pages to share your story with the world" />
    
    <!-- Open Graph / Facebook -->
    <meta property="og:type" content="website" />
    <meta property="og:url" content="https://yawmi.app" />
    <meta property="og:title" content="Yawmi - Share Your Story" />
    <meta property="og:description" content="Create beautiful pages to share your story with the world" />
    <meta property="og:image" content="/og-default.png" />
    <meta property="og:site_name" content="Yawmi" />
    
    <!-- Twitter -->
    <meta property="twitter:card" content="summary_large_image" />
    <meta property="twitter:url" content="https://yawmi.app" />
    <meta property="twitter:title" content="Yawmi - Share Your Story" />
    <meta property="twitter:description" content="Create beautiful pages to share your story with the world" />
    <meta property="twitter:image" content="/og-default.png" />

    <!-- Service worker registration -->
    <script>
      // Register service worker for cache management
      if ('serviceWorker' in navigator) {
        navigator.serviceWorker.register('/sw.js').catch(function(error) {
          console.error('Service Worker registration failed:', error);
        });
      }
    </script>
    <script type="module" crossorigin src="/assets/app-WYSYzm_T.js"></script>
    <link rel="stylesheet" crossorigin href="/assets/style-pH5rDLgt.css">
  </head>
  <body style="background-color: #0f0f0f; margin: 0;">
    <div id="root"></div>
  </body>
</html>
