<IfModule mod_rewrite.c>
    RewriteEngine On

    # ── Security: block direct access to Laravel source ──────────────────────
    RewriteRule ^(app|bootstrap|config|database|resources|routes|tests|vendor)(/|$) - [F,L]
    RewriteRule ^(\.env|artisan|composer\.json|composer\.lock|package\.json)$ - [F,L]

    # ── Authorization header passthrough ─────────────────────────────────────
    RewriteCond %{HTTP:Authorization} .
    RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

    # ── Serve uploaded files (storage symlink) ────────────────────────────────
    RewriteRule ^storage/(.*)$ public/storage/$1 [L,QSA]

    # ── Serve static assets from public/ ─────────────────────────────────────
    RewriteRule ^(css|js|images|fonts|img)(/.+)$ public/$1$2 [L,NC]
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteRule ^(.+\.(css|js|png|jpg|jpeg|gif|ico|svg|webp|woff|woff2|ttf|eot|pdf|map|mp4|mp3))$ public/$1 [L,NC]
    RewriteRule ^(favicon\.ico|robots\.txt)$ public/$1 [L]

    # ── Route all PHP requests through Laravel ────────────────────────────────
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteRule ^ index.php [L]

</IfModule>