Deliora quickstart: install in minutes

DELIORA — QUICKSTART
====================

REQUIREMENTS
------------
  - PHP 8.0+ with extensions: pdo, pdo_sqlite (or pdo_mysql), fileinfo
  - MySQL 5.7+ OR SQLite 3 (SQLite requires no extra setup)
  - A web server (Apache with mod_rewrite, or Nginx with try_files)
  - Optional: SMTP credentials for real buyer emails. Without them, all
    transactional mail is stored in the admin Outbox (evaluation mode).

SHARED HOSTING / CPANEL (RECOMMENDED FOR MOST BUYERS)
------------------------------------------------------
1. Upload the contents of the `app/` folder to your web root (e.g. public_html/)
   or a subdirectory (e.g. public_html/store/).

2. Make sure the data/ directory is writable by PHP.
   Via cPanel File Manager: right-click -> Permissions -> 755 or 775.

3. Visit https://yourdomain.com/install/ in your browser.

4. Fill in the installer:
     - Database: MySQL (host/name/user/pass) or SQLite (no setup)
     - Store name, currency, timezone
     - Admin email + password

5. The installer writes config.php and redirects you to the login page.

6. Log in -> Products -> New product. Add editions (single/extended/saas),
   upload each edition's ZIP deliverable, upload screenshots, publish.

7. Payments start in DEMO mode: the storefront's Buy button opens a built-in
   simulated checkout that exercises the FULL fulfillment loop (order, license
   key, download link, outbox email) with no real money. Try it end to end.

GOING LIVE WITH REAL PAYMENTS
-----------------------------
  Deliora hands checkout to a payment provider (Lemon Squeezy or Stripe) and
  fulfills from their signed webhooks — card data never touches your server.

  1. Settings -> Payments: pick your provider, add its webhook secret
     (write-only), and set each edition's checkout URL / variant / price ID.
  2. Point the provider's webhook at: https://yourdomain.com/webhook/lemonsqueezy
     (or /webhook/stripe).
  3. IMPORTANT — crypto modules: webhook SIGNATURE VERIFICATION and HMAC
     license signing are fully implemented (see README "Crypto modules").
     Any non-demo webhook whose signature does not verify is REJECTED (fail
     closed) — nothing can be forged, and nothing will fulfill. The demo
     provider is fully functional for evaluation with no real money.

DEMO DATA (OPTIONAL, LOCAL EVALUATION)
--------------------------------------
  php bin/demo.php
  Login: admin@deliora.app with the one-time password it prints
  Loads a sample store: 4 products, 10 orders, licenses with activations,
  a refunded order, and outbox emails.

LOCAL PREVIEW WITHOUT APACHE
----------------------------
  php -S 127.0.0.1:8080 router.php
  then open http://127.0.0.1:8080/install/

LICENSE API (FOR YOUR OWN PRODUCTS)
-----------------------------------
  POST /license/check    JSON {"key":"OWX-...","sku":"your-product-slug"}
  POST /license/activate JSON {"key":"OWX-...","sku":"...","domain":"client.com"}
  -> {"valid":true,"tier":"single","activations_left":2,"reason":""}
  Re-activating the same domain never consumes an extra slot.

TROUBLESHOOTING
---------------
  - 500 after upload: data/ not writable, or PHP < 8.0
  - "Session expired" on every form: cookies blocked or PHP sessions broken
  - Buy button says "no checkout link configured": set the edition's checkout
    URL (or variant/price ID) in the product editor, or stay in demo mode
  - Downloads 404: the edition has no ZIP uploaded yet
  - Emails not arriving: SMTP unconfigured -> check the admin Outbox

LOOKING AFTER IT (from 4.0)
---------------------------
  * Updates: open Updates in the menu, save your license key once, press Check for updates.
    Reaching 4.0 from 3.x is the last update by hand: replace the files; config.php and data/ stay.
  * Sample data: the installer offers to start with a sample; remove it later with one click.
  * Backups: "Back up once a day by itself" is on by default (/admin/restore); add an S3-compatible bucket there for
    a copy somewhere else. The Health page (/admin/health) says whether all of this is working.
  * On Nginx: use the server block in the manual ("On Nginx: keep data/ private", https://ownware.io/p/deliora/manual);
    it opens the installer and keeps data/ private.
  * One-line install for technical owners:
    curl -fsSL https://ownware.io/install.sh | sh -s -- deliora <your license key>