Deliora Quickstart, as shipped in the download

DELIORA — QUICKSTART
====================

REQUIREMENTS
------------
  - PHP 8.0+ with extensions: pdo, pdo_sqlite (or pdo_mysql), fileinfo
  - MySQL 5.7+ OR SQLite 3 (SQLite requires no extra setup)
  - A web server (Apache with mod_rewrite, or Nginx with try_files)
  - Optional: SMTP credentials for real buyer emails. Without them, all
    transactional mail is stored in the admin Outbox (evaluation mode).

SHARED HOSTING / CPANEL (RECOMMENDED FOR MOST BUYERS)
------------------------------------------------------
1. Upload the contents of the `app/` folder to your web root (e.g. public_html/)
   or a subdirectory (e.g. public_html/store/).

2. Make sure the data/ directory is writable by PHP.
   Via cPanel File Manager: right-click -> Permissions -> 755 or 775.

3. Visit https://yourdomain.com/install/ in your browser.

4. Fill in the installer:
     - Database: MySQL (host/name/user/pass) or SQLite (no setup)
     - Store name, currency, timezone
     - Admin email + password

5. The installer writes config.php and redirects you to the login page.

6. Log in -> Products -> New product. Add editions (single/extended/saas),
   upload each edition's ZIP deliverable, upload screenshots, publish.

7. Payments start in DEMO mode: the storefront's Buy button opens a built-in
   simulated checkout that exercises the FULL fulfillment loop (order, license
   key, download link, outbox email) with no real money. Try it end to end.

GOING LIVE WITH REAL PAYMENTS
-----------------------------
  Deliora hands checkout to a payment provider (Lemon Squeezy or Stripe) and
  fulfills from their signed webhooks — card data never touches your server.

  1. Settings -> Payments: pick your provider, add its webhook secret
     (write-only), and set each edition's checkout URL / variant / price ID.
  2. Point the provider's webhook at: https://yourdomain.com/webhook/lemonsqueezy
     (or /webhook/stripe).
  3. IMPORTANT — crypto modules: webhook SIGNATURE VERIFICATION and HMAC
     license signing are fully implemented (see README "Crypto modules").
     Any non-demo webhook whose signature does not verify is REJECTED (fail
     closed) — nothing can be forged, and nothing will fulfill. The demo
     provider is fully functional for evaluation with no real money.

DEMO DATA (OPTIONAL, LOCAL EVALUATION)
--------------------------------------
  php bin/demo.php
  Login: admin@deliora.app / admin123
  Loads a sample store: 4 products, 10 orders, licenses with activations,
  a refunded order, and outbox emails.

LOCAL PREVIEW WITHOUT APACHE
----------------------------
  php -S 127.0.0.1:8080 router.php
  then open http://127.0.0.1:8080/install/

LICENSE API (FOR YOUR OWN PRODUCTS)
-----------------------------------
  POST /license/check    JSON {"key":"OWX-...","sku":"your-product-slug"}
  POST /license/activate JSON {"key":"OWX-...","sku":"...","domain":"client.com"}
  -> {"valid":true,"tier":"single","activations_left":2,"reason":""}
  Re-activating the same domain never consumes an extra slot.

TROUBLESHOOTING
---------------
  - 500 after upload: data/ not writable, or PHP < 8.0
  - "Session expired" on every form: cookies blocked or PHP sessions broken
  - Buy button says "no checkout link configured": set the edition's checkout
    URL (or variant/price ID) in the product editor, or stay in demo mode
  - Downloads 404: the edition has no ZIP uploaded yet
  - Emails not arriving: SMTP unconfigured -> check the admin Outbox