# H.R. Vista — shared cPanel (Apache) routing, no Node.js required
Options -Indexes

<IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteBase /

  # Block sensitive paths
  RewriteRule ^config\.php$ - [F,L]
  RewriteRule ^config\.sample\.php$ - [F,L]
  RewriteRule ^\.installed$ - [F,L]
  RewriteRule ^lib/ - [F,L]

  # API: /api/... -> api/index.php/...
  RewriteCond %{REQUEST_FILENAME} !-f
  RewriteRule ^api/(.*)$ api/index.php/$1 [QSA,L]

  # Existing files/dirs pass through (assets, install.php, etc.)
  RewriteCond %{REQUEST_FILENAME} -f [OR]
  RewriteCond %{REQUEST_FILENAME} -d
  RewriteRule ^ - [L]

  # Front controller
  RewriteRule ^ index.php [L]
</IfModule>

# PHP settings commonly available on shared hosts
<IfModule mod_php.c>
  php_value session.cookie_httponly 1
</IfModule>
