# ── Add-on code is PHP-included from disk, never served directly ──────────────
# (mirrors the nginx deny for lib/ auth/ layout/ … in the admin vhost)
RedirectMatch 404 ^/.*/Addons/.*$

# ── URL compatibility layer (Apache / local WAMP) ─────────────────────────────
# The root PHP endpoints were organized into folders (actions/ serve/ apps/
# public/) — but every old root URL is load-bearing: fetch() targets in screens,
# links baked into sent emails, webhook configs, the mobile app. These rewrites
# keep every historic URL working forever. The nginx twin lives in the admin
# vhost (see provisioning/nginx/admin.tpl). Keep both in sync.
RewriteEngine On

# screen action endpoints (POST JSON, auth+CSRF)
RewriteRule ^([a-z0-9]+-action|actions)\.php$ actions/$1.php [L]

# downloads / exports / feeds / previews
RewriteRule ^(files-download|reports-export|audit-export|vm-disk-download|virt-isos|virt-iso|vm-screenshot|shot|paystudio-print|notifs-feed|loginui-preview|2fa-qr|sdk-download)\.php$ serve/$1.php [L]

# mini-apps: email builder, consoles, adminer
RewriteRule ^(builder|builder-save|builder-asset|vm-console|lxd-console|portal-console|adminer)\.php$ apps/$1.php [L]

# public / external endpoints (no panel session)
RewriteRule ^(api-try|verify-api|push-subscribe|unsubscribe|pipeline-webhook|webmail-sso|pma-signon)\.php$ public/$1.php [L]
