RewriteEngine On

# Allow the embedded Content Manager's explicit public surface. All other
# aismart-core paths remain unavailable from the web.
RewriteRule ^aismart-core/public/(?:admin/token(?:/.*)?|assets/(?:backend|frontend|global|page-builder|payment)/.*)$ - [L]

# The bundled Laravel code is an internal library, not a public application.
RewriteRule ^(?:aismart-core|wordpress-public)(?:/|$) - [F,L]

# Block direct access to sensitive build/config files under plugin path.
<FilesMatch "^(\.env(\..*)?|composer\.(json|lock)|phpunit\.xml|artisan|\.gitignore|\.gitattributes)$">
	Require all denied
</FilesMatch>