Relocate schema into includes/database.php

.github/copilot-instructions.md

@@ -25,23 +25,23 @@ When generating code for this repository:
 ## Project Structure
 
 ```
-npc/                       # Repository root (install to plugins/npc/ in Cacti)
-├── controllers/             # Request/action controllers
-├── css/ js/                   # Frontend assets (ExtJS-based UI)
-├── lib/                          # Command class and supporting library code
-├── locales/                        # Internationalization files
-├── models/                           # Data model helpers
-├── queries/                            # Data query definitions
-├── cli.php                               # CLI entry point
-├── config.php                              # Plugin-specific configuration
-├── nagioscmd.php                             # Nagios external command interface
-├── npc.php                                     # Main NPC UI entry point
-├── perfdata.php                                  # Performance data ingestion
-├── top_graph_header.php                            # Graph header integration
-├── upgrade_schema.sql                                # Schema upgrade reference
-├── INFO                                                # Plugin metadata (name, version, compat)
+npc/                     # Repository root (install to plugins/npc/ in Cacti)
+├── controllers/         # Request/action controllers
+├── css/ js/             # Frontend assets (ExtJS-based UI)
+├── lib/                 # Command class and supporting library code
+├── locales/             # Internationalization files
+├── models/              # Data model helpers
+├── queries/             # Data query definitions
+├── cli.php              # CLI entry point
+├── config.php           # Plugin-specific configuration
+├── nagioscmd.php        # Nagios external command interface
+├── npc.php              # Main NPC UI entry point
+├── perfdata.php         # Performance data ingestion
+├── top_graph_header.php # Graph header integration
+├── upgrade_schema.sql   # Schema upgrade reference
+├── INFO                 # Plugin metadata (name, version, compat)
 ├── README.md
-└── setup.php                                            # Plugin install/uninstall/upgrade hooks
+└── setup.php            # Plugin install/uninstall/upgrade hooks
 ```
 
 ## Naming Conventions
@@ -185,3 +185,7 @@ existing code or adding new code, not just in dedicated cleanup passes:
   line, `@param` lines, a blank comment line, then `@return`. Infer parameter/return types from
   actual usage; don't change the function's real type-hints in the same pass (let static analysis
   flag mismatches separately). Skip vendored third-party library files.
+
+## File manifest & upgrade pruning
+
+The plugin ships a root `manifest.json` with three arrays: `tombstones` (files/directories older versions shipped that have since moved or been removed), `expected` (the top-level files and directories that ship today, directories written with a trailing `/`), and `whitelist` (paths holding user data that must never be touched). Keep `expected` current: CI runs `tests/bin/validate-manifest.php`, which fails on any drift between `expected` and the real top-level tree (it ignores `tests/`, `phpunit.xml`, `.git*`, `.md*`, and whitelisted paths). Custom customer CSS/theme files belong in `expected`, and stylesheets live in `css/` (not `themes/`). On upgrade, `npc_prune_files()` deletes the tombstoned paths, the dev-only `tests/` tree, and the `phpunit.xml` test config, leaves `whitelist`, `.git*`, and `.md*` alone, and logs (without removing) any top-level entry the manifest does not account for. As a safety measure it refuses any tombstone that resolves outside the plugin directory (a tampered manifest.json) and logs a warning for any file or directory it cannot remove. When you move or delete a shipped file, add its old path to `tombstones` and update `expected` in the same change.

.github/workflows/plugin-ci-workflow.yml

@@ -88,6 +88,9 @@ jobs:
     - name: Check PHP version
       run: php -v
 
+    - name: Validate plugin manifest (expected-file drift)
+      run: php cacti/plugins/npc/tests/bin/validate-manifest.php
+
     - name: Run apt-get update
       run: sudo apt-get update
 

CHANGELOG.md

@@ -2,6 +2,12 @@
 
 --- develop ---
 
+* dev: Relocate the schema provisioning function `npc_setup_tables()` from
+  `setup.php` into `includes/database.php` (loaded via `require_once`) to align
+  with the fleet schema/includes convention; behavior is unchanged
+* dev: Add a root `manifest.json` file manifest with upgrade-time pruning
+  (`npc_prune_files()`) that removes tombstoned and dev-only paths on
+  version change, plus a CI `validate-manifest.php` drift check
 * dev: Measure CI coverage with xdebug instead of pcov so the plugin's own sources are instrumented (pcov auto-scopes to the Composer root and skipped cacti/plugins/, leaving the patch-coverage gate with nothing to measure)
 * dev: Enforce patch coverage of changed lines in CI and remove the inert COMPOSER_ROOT_VERSION env from the Pest step
 * security: Add a version-safe CSP nonce (`plugin_npc_csp_nonce()`) to every inline `<script>` tag so pages stay compatible with Cacti's Content-Security-Policy nonce enforcement, while falling back cleanly on older Cacti releases that lack the `CactiSecureHeaders` class