# WebMarket production deployment

This release preserves the 100-table Modesy 2.7 baseline. The SQL dump remains a controlled database import and is not bundled with the application release. Laravel migrations are additive: they prepare the existing `users` table, add WebMarket infrastructure, and add audit/idempotency fields without renaming, truncating, dropping, or normalizing legacy business tables.

## Fresh baseline

Create a new MySQL/MariaDB database, import the authoritative `modernstore.sql` backup with the database client or phpMyAdmin, and verify that the legacy audit passes before running additive migrations:

```bash
cp .env.example .env
php artisan key:generate
php artisan optimize:clear
php artisan webmarket:legacy-audit
php artisan migrate --force
php artisan db:seed --class=Database\\Seeders\\ProductionRolesPermissionsSeeder --force
php artisan webmarket:legacy-integrity
php artisan storage:link
php artisan optimize
php artisan webmarket:deployment-check
```

Run the same sequence against a disposable copy first. Never use `migrate:fresh`, `db:wipe`, table truncation, or destructive rollback against the imported database.

## Existing installation upgrade

Take a database and upload backup, deploy this release beside the current release, point the new `.env` at the backup or maintenance-mode database, and run:

```bash
php artisan optimize:clear
php artisan webmarket:legacy-audit --json > storage/logs/legacy-audit.json
php artisan migrate --force
php artisan db:seed --class=Database\\Seeders\\ProductionRolesPermissionsSeeder --force
php artisan webmarket:legacy-integrity --json > storage/logs/legacy-integrity.json
php artisan webmarket:import-uploads /absolute/path/to/modesy --dry-run
php artisan webmarket:import-uploads /absolute/path/to/modesy
php artisan webmarket:import-uploads /absolute/path/to/modesy --verify
php artisan storage:link
php artisan optimize
php artisan webmarket:deployment-check
```

The audit and integrity commands are read-only. Resolve reported missing tables, missing core columns, duplicate login emails, duplicate public identifiers, or orphaned records before cutover. Preserve the original upload paths; the importer copies them under `storage/app/public/uploads` and records a private SHA-256 manifest.

## Installer and licensing

The installer is disabled by default. For a controlled first install, set `INSTALLER_ENABLED=true` only in a private deployment window, visit `/install`, and complete the resumable requirements, database, migration, administrator, company, license, and completion steps. The installer writes no credentials to logs and locks itself at `storage/app/private/installed`; set `INSTALLER_ENABLED=false` after completion. The application license is separate from digital-product license keys. Successful remote verification is cached, temporary connection failures honor the configured grace period, and explicit invalid, expired, suspended, or revoked responses fail closed.

Do not commit `.env`, license keys, payment secrets, database passwords, logs, upload manifests, or customer data.

## Shared hosting

Set the domain document root to `public/`, make `storage/` and `bootstrap/cache/` writable, and configure a cron entry:

```text
* * * * * cd /absolute/path/to/webmarket && php artisan schedule:run >> /dev/null 2>&1
```

Use file-backed sessions and cache as the initial baseline. Process the database queue with a short-lived worker compatible with the host, for example `php artisan queue:work database --stop-when-empty --max-time=50 --tries=3`, and ensure only one scheduler invocation is active. Configure HTTPS, `APP_DEBUG=false`, SMTP, payment webhook URLs, and the license endpoint before launch.

## Rollback

Put the site in maintenance mode, retain the release directory, restore the last known-good database backup and upload backup, point the document root back to the previous release, clear its caches, and verify login, checkout, downloads, payments, refunds, and support. Do not use a destructive Laravel rollback to undo the legacy import; schema rollback is not a substitute for restoring the verified database backup.

## Authorization compatibility

The preserved `roles_permissions` table remains authoritative because legacy users reference its integer role IDs and permission storage. `ProductionRolesPermissionsSeeder` adds the eight required role meanings and stable granular permission names without replacing existing rows, changing user role IDs, or assigning a default administrator password. The installed Spatie package remains available for future modules, but it is not mapped onto the legacy table because doing so would risk breaking existing authorization data.