# BEGIN LINKFIELD MANAGED PROXY
ServerSignature Off
<IfModule mod_headers.c>
  Header always unset X-Powered-By
</IfModule>
<IfModule mod_rewrite.c>
  RewriteEngine On

  # Safe bootstrap: use the bounded PHP bridge until the Node server
  # writes a verified current proxy port after it begins listening.
  RewriteCond %{REQUEST_FILENAME} !-f
  RewriteRule ^api/(.*)$ api-bridge.php?path=/api/$1 [QSA,L]

  # The service source may share this directory with Apache. Expose only
  # the curated browser bundle and deny every other direct file request.
  RewriteRule ^$ - [L]
  RewriteRule ^(?:index\.html|style\.css|favicon\.(?:svg|ico)|build-meta\.js|runtime-config\.js|shared-contracts\.js|store-catalog\.(?:generated\.js|json)|puzzle-patterns\.js|puzzle-core\.js|app-logic\.js|archive-codec\.js|field-persistence(?:-worker)?\.js|puzzle-worker\.js|app\.js|api-bridge\.php)$ - [L]
  RewriteRule ^(?:assets|client)(?:/|$) - [L]
  RewriteRule ^ - [F,L]
</IfModule>
<FilesMatch "(?i)^(?:\.|server\.js$|realtime-server\.js$|package(?:-lock)?\.json$|build-config\.json$|README\.md$)">
  Require all denied
</FilesMatch>
# END LINKFIELD MANAGED PROXY