# Closed database bundle

This directory contains sanitized SQL artifacts for fast NVR install, restore
and validation scenarios.

Files:

- `plataforma_central_schema.sql`: schema only. This is the safe restore
  artifact for production/bootstrap flows before migrations, seeders and a
  strong initial admin are applied by the installer.
- `plataforma_central_dev_seeded.sql`: schema plus sanitized development/test
  data generated from `php platform/artisan migrate --force` followed by
  `php platform/artisan db:seed --force`. This file contains active synthetic
  users, clients, gateways and licenses for validation only. Do not restore it
  into production. Production ZIPs must not include this dump; packaging
  removes it from the final artifact so fixture data cannot be restored by
  accident.
- `plataforma_central_nvr_patch.sql`: product/entitlement patch for installing
  the NVR product into an existing central portal database.

The bundle must not contain production customer data, real tokens, real
application keys, runtime sessions, logs, rate limits or SQLite gateway state.
All dumps are sanitized to remove MariaDB/MySQL `DEFINER` clauses.

Build:

```bash
bash scripts/database/build-closed-db.sh
php scripts/check-closed-database-bundle.php
```

Schema-only restore:

```bash
bash scripts/database/restore-closed-db.sh database/closed/plataforma_central_schema.sql
```

By default the restore script imports schema-only SQL into `plataforma_central`.
For development/test fixtures, restore the seeded dump only into an isolated
database with an explicit opt-in:

```bash
APP_ENV=development \
ALLOW_DEV_SEEDED_RESTORE=1 \
CLOSED_RESTORE_DB=nvr_dev_restore \
bash scripts/database/restore-closed-db.sh database/closed/plataforma_central_dev_seeded.sql
```

The restore script refuses dev-seeded dumps when `APP_ENV=production` or when
`APP_ENV` is unset, refuses them without `ALLOW_DEV_SEEDED_RESTORE=1`, and
requires `CLOSED_RESTORE_DB` to avoid writing fixture data into
`plataforma_central`.

Production artifact guard:

```bash
php scripts/check-package-hygiene.php /path/to/extracted/package
php scripts/check-closed-database-bundle.php /path/to/extracted/package
```

Both checks fail a production package if the dev-seeded SQL dump, seed markers
or fixture `INSERT` statements are present at
`database/closed/plataforma_central_dev_seeded.sql`.
