# Pretty URLs — route everything through index.php
RewriteEngine On

# Protect sensitive files
<FilesMatch "^(config\.php|composer\.(json|lock))$">
    Order allow,deny
    Deny from all
</FilesMatch>

# Block access to app/, vendor/, templates/, templates_c/
RewriteRule ^(app|vendor|templates|templates_c)/.* - [F,L]

# Allow assets/
RewriteRule ^assets/.* - [L]

# If no file matches, route to install.php (if config missing) or index.php
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{DOCUMENT_ROOT}/config.php !-f
RewriteRule ^ install.php [L]

RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^ index.php [L]
