# =====================================================================
#  Nexa Admin
# =====================================================================

# Environment — contains database credentials. Never commit.
.env
.env.*.local

# Runtime-generated. Nothing here is source.
/storage/logs/*
/storage/cache/*
/storage/sessions/*
/storage/uploads/*
/storage/temp/*

# Upload fixtures the test suite builds and removes per test.
/storage/test-uploads/*

!/storage/**/.gitkeep

# The original 81-page Nexa demo template, kept as the design reference for
# page conversion. Large, vendor-supplied, and not source we maintain.
/_template-reference/

# Describes a different product than what actually ships — see the codebase
# analysis. Kept on disk for reference but not treated as a build manifest.
/node_modules/

# Editors and OS
.DS_Store
Thumbs.db
desktop.ini
.idea/
.vscode/
*.swp
*.swo
*~

# Logs and dumps
*.log
*.sql.gz

# =====================================================================
#  Unithink discovery material — NEVER COMMIT
# =====================================================================
#
# These three arrived in the working directory for the Unithink discovery
# audit. All of them sit inside this repository, so without these rules a
# single `git add -A` commits them permanently into history.
#
# fictionh_unithink_new.sql is a PRODUCTION DATABASE DUMP. It was inspected
# and contains a `users` table with password hashes, plus email, mobile and
# phone columns across several tables — real credentials and real personal
# data. Committing it would publish both, and `git rm` afterwards does not
# remove it from history.
#
# website-frontend/ is 136 MB of live site and the legacy 1010 admin. It is
# read-only reference material for the audit, not source this repository
# maintains, and it would bloat every clone permanently.
#
# future-requirement/ is client planning material.
#
# Read them in place. Do not add them.
/fictionh_unithink_new.sql
/future-requirement/

# ---------------------------------------------------------------------
#  website-frontend — mostly ignored, with one deliberate exception
# ---------------------------------------------------------------------
#
# 136 MB of live site: 441 PNGs, 416 SVGs, 22 MB of vendor JS/CSS, 16 MB of
# uploaded files. None of that belongs in this repository.
#
# The exception is the legacy 1010 PHP SOURCE (1.2 MB, 92 files). Phase 8.0
# modifies it to close live security holes, and a security fix with no
# version control has no rollback and no audit trail. Tracking the source
# only — never the binaries — costs almost nothing and makes every change
# reviewable and revertible.
/website-frontend/**

!/website-frontend/
!/website-frontend/1010/
!/website-frontend/1010/**/
!/website-frontend/1010/**/*.php
!/website-frontend/1010/**/.htaccess

# Vendor libraries, uploads and images stay out regardless of extension.
/website-frontend/1010/assets/**
/website-frontend/1010/files/**
/website-frontend/1010/images/**
/website-frontend/1010/cgi-bin/**

# NEVER. Holds the production database host, user and password in plaintext.
# Excluded last so no negation above can re-include it.
/website-frontend/1010/lib/db/connection.php

# Any other database dump, wherever it lands.
*.sql
!/database/migrations/*.sql

# Deployment packages. Reproducible from any commit via
# deploy/build-release.sh, so the artefact itself is not source.
/build/
