t

.htaccess

@@ -1,22 +1,24 @@
 # BEGIN LINKFIELD MANAGED PROXY
+ServerSignature Off
+<IfModule mod_headers.c>
+  Header always unset X-Powered-By
+</IfModule>
 <IfModule mod_rewrite.c>
   RewriteEngine On
 
-  # Prefer a native Apache proxy when the host permits it.
-  <IfModule mod_proxy.c>
-    <IfModule mod_proxy_wstunnel.c>
-      RewriteCond %{HTTP:Upgrade} =websocket [NC]
-      RewriteRule ^api/realtime/?$ ws://127.0.0.1:32956/api/realtime [P,L]
-    </IfModule>
-    RewriteRule ^api/(.*)$ http://127.0.0.1:32956/api/$1 [P,L]
-  </IfModule>
-
-  # Shared hosts often disable mod_proxy. Route ordinary API requests
-  # through the bundled PHP bridge instead.
+  # Safe bootstrap: use the bounded PHP bridge until the Node server
+  # writes a verified current proxy port after it begins listening.
   RewriteCond %{REQUEST_FILENAME} !-f
   RewriteRule ^api/(.*)$ api-bridge.php?path=/api/$1 [QSA,L]
+
+  # The service source may share this directory with Apache. Expose only
+  # the curated browser bundle and deny every other direct file request.
+  RewriteRule ^$ - [L]
+  RewriteRule ^(?:index\.html|style\.css|favicon\.(?:svg|ico)|build-meta\.js|runtime-config\.js|shared-contracts\.js|store-catalog\.(?:generated\.js|json)|puzzle-patterns\.js|puzzle-core\.js|app-logic\.js|archive-codec\.js|field-persistence(?:-worker)?\.js|puzzle-worker\.js|app\.js|api-bridge\.php)$ - [L]
+  RewriteRule ^(?:assets|client)(?:/|$) - [L]
+  RewriteRule ^ - [F,L]
 </IfModule>
-<Files ".linkfield-port">
+<FilesMatch "(?i)^(?:\.|server\.js$|realtime-server\.js$|package(?:-lock)?\.json$|build-config\.json$|README\.md$)">
   Require all denied
-</Files>
+</FilesMatch>
 # END LINKFIELD MANAGED PROXY