<!-- file: README.md -->

# SANEKSA — Premium creative studio (custom PHP MVC)

SANEKSA is a production-grade creative studio website: custom PHP 8.2+ architecture (no Laravel), MySQL, Tailwind CSS (build pipeline), modular ES modules with optional Three.js hero, and a full admin panel. Brand display name is driven by `APP_NAME` and `site_settings.brand_name`.

## Stack

- PHP 8.2+, Composer PSR-4 (`App\` → `app/`)
- MySQL 8+ (InnoDB, utf8mb4)
- Tailwind CSS 3 + PostCSS + Autoprefixer (`public/assets/css/main.css`)
- Native ES modules loaded with `type="module"` from `public/assets/js/app.js` (no JS bundler required)
- Vanilla JS modules (preloader, menu, cursor, sound, transitions, canvas hero, forms, a11y)

## Folder structure

See repository root: `app/`, `bootstrap/`, `config/`, `database/`, `public/`, `routes/`, `storage/`, `lang/`, `.cursor/`.

## Prerequisites

- PHP 8.2+ with extensions: `pdo_mysql`, `json`, `mbstring`
- MySQL server
- Node.js 18+ and npm (for asset build)
- MAMP (or Apache/Nginx) with document root pointing to `public/`

## Installation

1. Clone or copy the project into your web root (e.g. `htdocs/saneksa`).

2. Install PHP dependencies:

```bash
cd /path/to/saneksa
composer install
```

3. Copy environment file and edit database credentials:

```bash
cp .env.example .env
```

Set at least: `DB_NAME`, `DB_USER`, `DB_PASS`, `APP_URL` (include subdirectory if used, e.g. `http://localhost:8888/saneksa/public`), `ADMIN_EMAIL`, `ADMIN_PASSWORD`.

4. Create the MySQL database (empty):

```sql
CREATE DATABASE saneksa CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
```

5. Run migrations and seed:

```bash
php migrate.php
php seed.php
```

`seed.php` inserts demo content (6+ projects, services, journal posts, careers) and upserts the admin user from `.env`. It skips if six or more projects already exist.

6. Install Node dependencies and compile Tailwind:

```bash
npm install
npm run build
```

This writes `public/assets/css/main.css` from `resources/css/app.css`. JavaScript uses native `import`/`export` under `public/assets/js/` (served directly by the web server).

Watch mode during development:

```bash
npm run watch:css
```

Composer is optional for runtime: if `vendor/autoload.php` is missing, a PSR-4 autoloader is registered from `bootstrap/app.php`, `migrate.php`, and `seed.php`.

## MAMP notes

- Prefer setting the site **document root** to `saneksa/public` so URLs stay clean (`/` instead of `/saneksa/public/`).
- If you must serve from a subpath, set `APP_URL` accordingly; the app uses `base_url()` derived from `SCRIPT_NAME` for links and assets.

## Admin

- URL: `/admin/login`
- Credentials: values from `.env` (`ADMIN_EMAIL`, `ADMIN_PASSWORD`) after `seed.php` (password is (re)hashed on seed).

Features: dashboard, projects/journal/services CRUD, contact inbox, careers + applications list, site settings, SEO meta, audio toggles.

## Routing

- Web: [`routes/web.php`](routes/web.php)
- API: [`routes/api.php`](routes/api.php)

API examples:

- `POST /api/contact` — JSON body with `_csrf` token (same token as `<meta name="csrf-token">` / form field)
- `GET /api/projects/filter?category=...`
## Security

- CSRF on form posts and JSON API contact when `_csrf` is provided
- PDO prepared statements
- Admin routes protected via [`app/Middleware/AuthMiddleware.php`](app/Middleware/AuthMiddleware.php)
- Session cookie `HttpOnly`, `SameSite=Lax`

## i18n

UI strings live in [`lang/en/messages.php`](lang/en/messages.php) and [`lang/tr/messages.php`](lang/tr/messages.php). The fullscreen menu posts to `/locale` to switch session locale.

## Performance

- Lazy-loaded images on cards (`loading="lazy"`)
- WebGL hero disabled on small viewports and when `prefers-reduced-motion: reduce`
- Page transition overlay skips `/admin` and `/api` links

## Media optimization

- Prefer WebP/AVIF where possible; keep large video off the critical path or host on CDN
- Use responsive `sizes` if you extend markup beyond the bundled placeholders

## Deploy

- Set `APP_ENV=production`, `APP_DEBUG=false`
- Point web server to `public/`
- Run `composer install --no-dev --optimize-autoloader` (if you use Composer) and `npm ci && npm run build`
- Ensure `storage/` and `public/uploads/` are writable

## JSON file header comment rule

Valid JSON cannot include comments. Do **not** add top-of-file comments to `composer.json` or `package.json`.

## License

Proprietary — SANEKSA project scaffold for the studio.
