Options -Indexes

RewriteEngine On

# ── Block direct access to sensitive internal directories ─────────────────────
RewriteRule ^shield/src/   - [F,L]
RewriteRule ^shield/data/  - [F,L]
RewriteRule ^vault/        - [F,L]

# ── Shield dynamic links ──────────────────────────────────────────────────────
# Pattern: /r followed by 4–32 lowercase hex chars, then slash + token
# e.g.  /r3f8a1c2/v2.abc.def.ghi.jkl
# Routes to shield gateway; does NOT interfere with any existing PHP files.
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_URI}      ^/r[a-f0-9]{4,32}/.+
RewriteRule ^                    shield/public/index.php [QSA,L]
