Options -Indexes -MultiViews
DirectoryIndex index.php
# Apache/cPanel: this directory can be uploaded as a subfolder such as members/.
# APP_URL must include that subfolder. Public-only document roots still work.
RewriteEngine On

# Keep dotfiles, source, database files, and private storage inaccessible.
RewriteRule "(^|/)\." - [F,END]
RewriteRule ^(?:app|config|database|bin|storage|tests|reference)(?:/|$) - [F,END,NC]
<FilesMatch "^\.">
    Require all denied
</FilesMatch>

# Requests already inside public/ are handled there. The PHP entrypoint guard
# still rejects direct /public/ account URLs when APP_URL uses the clean path.
RewriteRule ^public(?:/|$) - [L]

# Rewrite straight to files so DirectorySlash cannot expose /public/ in URLs.
RewriteRule ^$ public/index.php [END]
RewriteRule ^admin/?$ public/admin/index.php [END]
RewriteRule ^(index\.php|file\.php|admin\.php|admin/index\.php)$ public/$1 [END]
RewriteRule ^((?:css|js|assets)/.+\.(?:css|js|png|svg|html|jpg|jpeg|gif|ico|webp|woff2?|ttf|map))$ public/$1 [END]

# Root HTML templates, documentation, and unknown paths are not public pages.
RewriteRule ^ - [R=404,END]
