# Copilot Instructions

## Project shape
- Legacy PHP 5.x site generated with Artisteer templates; public pages live at the repo root (`index.php`, `home.php`, etc.) and share `style.css`, `script.js`, and `menumain.php`/`menugrower.php` includes for navigation.
- Grower self-service lives under `grower-login.php` and per-grower folders in `growers/` (e.g. `growers/999/`). Each grower folder wraps shared includes but serves files and PDF listings via `dtrlist.php`.
- Reporting utilities are under `loaddata/`, mixing PHP views with SQL Server queries. Shared helper includes, credentials, and menu snippets sit in `inc/`.
- `lasucadev/` contains vendor-style experiments (e.g. `ping/`) that normally stay untouched; treat as third-party source.
- Modernized theme assets live under `inc/theme-header.php`, `inc/theme-footer.php`, and `inc/theme-toggle.php`; they pull in Bootstrap-based styles from `new/css/` and behaviour from `new/js/scripts.js`.
- Custom styling bundles include `new/css/lasuca-theme.css` for global look-and-feel, `new/css/grower-portal.css` for authenticated pages, and `new/css/farmdata.css` for the load-data explorer.

## Recent updates
- Grower portal pages (`grower-dashboard.php`, `grower-files.php`, `grower-account.php`, etc.) now use the shared theme header/footer, the protected navigation, and quick-link tiles; keep using those includes for any new grower tools.
- The dashboard greeting reads from the `growername` column; profile edits persist via `auth_update_profile`. Avoid reverting to the old `firstname` fallback.
- Factory data cards on the dashboard reuse the query logic from `milldata.php`; ensure any future tweaks go through the shared helper in `inc/grower_dashboard.php`.
- A light/dark mode toggle is available site-wide through `inc/theme-toggle.php` and `new/js/scripts.js`, persisting state via `localStorage` and body classes (`theme-dark` default, `theme-light` override).
- Branding updates place `images/header.png` behind the navbar, add subtle drop shadows, and give the logo depth—mirror that pattern if new headers are introduced.
- `farmdata/index.php` has been rebuilt with the new theme, richer filters (grower, crop day, vehicle, tract, load, overload threshold), query helpers, and SQLSRV stubs for environments lacking the driver.

## Runtime & tooling
- Target PHP ≤5.6: the code relies on deprecated `mysql_*` APIs and short open tags in places (`<?`). Do not replace with `mysqli`/PDO unless coordinating a full migration.
- Development happens by serving the repo root through Apache/PHP or via `php -S localhost:8000` (requires the `sqlsrv` extension and Microsoft drivers if exercising scale reports).
- There are no automated tests; validate changes by hitting the relevant PHP endpoint in a browser.

## Application flows
- Public site: static-like pages include `menumain.php` and echo content blocks. Follow the pattern in `index.php` when adding pages.
- Grower portal: `grower-login.php` authenticates against the `scdb.members` table and redirects to a directory matching the username. Any new grower assets must be placed inside that username folder and linked through `dtrlist.php` or `loads.php`.
- Load data reports (`loaddata/index.php`) connect to SQL Server (`CBM2K12\SQLEXPRESS`, database `SugarCaneScale`) and display tabular results while accumulating totals. Reuse that query pattern when adding filters or exports.

## Data access patterns
- MySQL credentials live in `inc/dbconfig.php` and are consumed by `inc/opendb.php`; pages using MySQL typically `include` both and call `mysql_query`. Maintain that include order so globals (`$dbhost`, `$dbuser`, …) are defined.
- SQL Server access always happens inline with `sqlsrv_connect` + `sqlsrv_query` (see `loaddata/index.php`). Remember to free statements and close connections when you introduce long-running loops.
- Directory-based reports rely on `inc/dtrlistconfig.php` and `inc/dtrlistfunctions.php`; expose new report folders by placing files under the appropriate `growers/<id>/<year>/` path and letting `dtrlist.php` pick them up.

## UI conventions
- Theme pages should load through `inc/theme-header.php`/`inc/theme-footer.php`, which already enqueue Bootstrap, the theme palette, and the light/dark toggle. Only fall back to Artisteer layouts when touching untouched legacy pages.
- Prefer the utility classes defined in `new/css/lasuca-theme.css` and `new/css/grower-portal.css` before adding inline styles. When legacy Artisteer selectors such as the `vtitle` ID remain, leave them in place until that page is fully migrated.
- Front-end behaviour now lives primarily in `new/js/scripts.js`; keep scripts simple, avoid module loaders, and update the toggle helpers if you add new theme-aware widgets.

## Security & legacy quirks
- Session gating uses `$_SESSION['ena']` alone (`session.php`); when adding new protected pages, include that file first to preserve the redirect-on-failure behavior.
- Input sanitization is minimal (manual `mysql_real_escape_string`); mimic the existing approach and note any improvements separately rather than mixing refactors into feature work.
- Credentials are hard-coded throughout; do not rotate them casually—coordinate with ops and document any changes prominently.

## When in doubt
- Mirror the structure of a neighboring file before introducing new patterns.
- Keep compatibility front-of-mind: new PHP features or libraries can break production if the runtime remains on PHP 5.x.
- Document any new data sources, includes, or cron assumptions inside this file so future agents stay oriented.