RewriteEngine On

# Block direct access to private project areas.
RewriteRule ^(\.env|README\.md)$ - [F,L,NC]
RewriteRule ^(app|config|database|routes|storage)(/|$) - [F,L,NC]

# Serve front-end assets from /public/assets when the project root is the document root.
RewriteRule ^assets/(.*)$ public/assets/$1 [L]

# Let existing files and directories load normally.
RewriteCond %{REQUEST_FILENAME} -f [OR]
RewriteCond %{REQUEST_FILENAME} -d
RewriteRule ^ - [L]

# Everything else goes through the root front controller.
RewriteRule ^ index.php [QSA,L]
