# Lemon Squeezy launch runbook

This runbook separates work already implemented in the repository from actions
that require the seller's authenticated Lemon Squeezy, Cloudflare, banking, tax,
domain, legal, and code-signing identities.

Current signing status: the release's three first-party executables
and NSIS installer are signed with the active LINEKERPANDI LIMITED Azure
Artifact Signing public-trust profile, timestamped by Microsoft, and verified
after both portable-package and clean installer tests. This completes the
code-signing identity step; it does not configure the production service
secrets or complete the controlled live entitlement lifecycle and paid-purchase
gates below. The product owner confirmed independent legal approval for sale on
2026-08-27; supporting advice is retained outside the public repository.

## Current authenticated setup (2026-08-20)

- Lemon store ID `448537` is shared by the separated test and live
  environments. Test product ID `1278355` / variant ID `1998551` and live
  product ID `1304562` / variant ID `2040403` exist for **SmartCut64
  Personal**.
- The test product is configured as a GBP 4.99 one-time purchase with generated
  licence keys and a two-computer activation limit.
- Seller identity/KYC, bank details, 2FA, product creation, and receipt copy are
  complete. Lemon approved the store and Live Mode is available. The GBP 4.99
  live product was copied on 2026-08-20 and immediately returned to **Draft**,
  so it is not publicly purchasable. Exact-file delivery and the controlled
  live lifecycle remain to be completed before checkout is shared.
- The production public entitlement key and HTTPS activation-service URL are
  compiled into the signed commercial candidate. Its complete 91-test gate and
  exact paid-entitlement worker/CLI delivery gate pass. The production Worker
  shell is deployed but intentionally fails closed until the entitlement
  private key and live webhook secret are configured. Its ignored production
  configuration records only the approved live Lemon IDs and non-secret
  Cloudflare binding identifiers.
- A dedicated 3072-bit entitlement key has been generated outside the
  repository. Its public fingerprint is recorded in
  `docs/PRODUCTION_ENTITLEMENT_KEY.md` and its public half passed the commercial
  gate; two independently verified offline backups and production
  service-secret deployment remain open.
- A Lemon test-mode order has passed repeat activation, two-device enforcement,
  third-device rejection, deactivation/transfer, wrong-email rejection, signed
  refund-webhook revocation, and deployed rate-limit behavior. Exact-file
  receipt/download testing and one controlled live purchase/refund remain open.
- Original offline help is packaged from `docs/USER_GUIDE.md`, and the website
  source in `website/` provides product, features, formats, help, licensing,
  support, and release-readiness pages. It is deliberately independent rather
  than copied from VideoReDo documentation.

Use `docs/LEMON_UPLOAD_CHECKLIST.md` for the exact first-time-publisher upload
and test sequence. `scripts/prepare-store-upload.ps1` verifies checksums,
first-party signatures, source pairing, and the 1600x1200 store image before it
creates a non-overwriting prelaunch staging folder.

## Commercial offer

- Product: **SmartCut64 Personal**
- Billing: one-time purchase
- Launch price: **GBP 4.99** for the first 250 customers
- Standard price after the launch allocation: **GBP 19.99**
- Activations: 2 concurrent computers
- Included: official signed Windows builds, clean exports, 12 months of updates
  and email support
- Evaluation: full editor/preview; watermarked full-recode video output
- Refund policy: voluntary 30-day refund in addition to mandatory rights

The GBP 4.99 price is a deliberate founding-user offer, not the intended
permanent price. At very low permanent pricing, Lemon Squeezy's fixed
transaction component, support time, refunds, tax administration, and signing
costs consume a disproportionate share of revenue.

## 1. Seller account and legal identity

1. Create and verify the Lemon Squeezy seller account.
2. Complete identity/business, payout, bank, tax, and supported-country checks.
3. Confirm the LINEKERPANDI LIMITED identity and monitored contacts already
   inserted in `PRIVACY.md`, `CUSTOMER_TERMS.md`, `REFUND_POLICY.md`,
   `SUPPORT.md`, and `SECURITY.md`.
4. Have qualified counsel review those exact documents, GPL/LGPL delivery,
   codec patents, trademark/branding, digital-content consent, refunds, and the
   activation-service continuity promise in every intended territory.

These steps cannot be delegated to code or completed with invented details.

## 2. Product and variant

1. Create the one-time **SmartCut64 Personal** product.
2. Enable generated licence keys and set the activation limit to 2.
3. Create a private test variant and the live launch/standard price variants.
4. Copy the exact store, product, and allowed variant IDs into separate test
   and production bridge configurations.
5. Upload only the exact signed release installer/portable package and the
   matching source/checksum links. Do not upload a private entitlement key.
6. Use `docs/PRODUCT_LISTING.md` as the listing draft after its legal claims are
   approved.

Lemon's License API is separate from its general API and accepts form-encoded
HTTPS activate, validate, and deactivate calls. It is limited to 60 requests
per minute, so the bridge includes stricter Cloudflare native rate limits.

## 3. Production entitlement key

1. Generate a new 3072-bit production RSA key on a controlled machine with
   `tools/New-SmartCut64LicenseKey.ps1`.
2. Keep two encrypted offline backups under separate control.
3. Put the PKCS#8 private key into the Cloudflare Worker secret
   `SMARTCUT_PRIVATE_KEY_PEM`; never place it in Git, CMake, CI logs, Lemon, or
   a distributed package.
4. Configure only the public modulus/exponent in the release CMake cache.
5. Record the public-key fingerprint and key-rotation/incident procedure.

The existing personal-development key must not be reused for sale.

## 4. Deploy the activation bridge

1. In `services/licensing-bridge`, copy `wrangler.toml.example` to the ignored
   `wrangler.toml`.
2. Create separate test/live KV namespaces and use unique rate-limit namespace
   integers for each environment. Seed `system:namespace-marker:v1` with the
   source-pinned test or production marker documented in the bridge README;
   read it back from the exact namespace before deployment.
3. Set the exact Lemon IDs. Version 1 issues a perpetual machine-bound
   entitlement and therefore has no entitlement TTL.
4. Set `SMARTCUT_LICENSE_PUBLIC_MODULUS_HEX` to the exact public modulus in the
   corresponding release build, and configure `SMARTCUT_PRIVATE_KEY_PEM` and
   `LEMON_WEBHOOK_SECRET` as Worker secrets. Do not use an immediate production
   `wrangler secret put`: create an undeployed version with
   `wrangler versions secret put`, place it at 0% traffic, and prove `/ready`
   against that exact version with a version override before promotion.
5. Deploy test first; configure signed `order_refunded` and
   `license_key_updated` webhooks at `/v1/webhooks/lemon`.
6. Exercise purchase, activation, second activation, third-device rejection,
   perpetual offline use, deactivation/transfer, full refund, disabled key, wrong email,
   wrong product, timeout, and rate-limit paths.
7. Deploy live on a seller-controlled HTTPS hostname and configure release
   CMake with `-DSMARTCUT_LICENSE_SERVICE_URL=https://<host>`.
8. Restrict Cloudflare account access, require MFA, monitor 429/5xx/webhook
   failures, back up non-secret operational records, and document recovery.

For every production code, configuration or secret change, follow
`services/licensing-bridge/README.md`'s fail-safe deployment gate. A production
candidate is not promotable until its version-specific readiness response
matches the candidate version ID, proves the signing key against the public
fingerprint pinned to the live Lemon product, and reads the product-pinned
marker from the bound production KV namespace.

## 5. Build, sign, and publish one immutable release set

1. Configure the production public entitlement key and service URL.
2. Build the release preset and run the complete test matrix.
3. Issue a paid release-test entitlement for the release machine.
4. Run `scripts/release-gate.ps1 -PaidTestLicense <path>` on a clean commit.
5. Code-sign every EXE/DLL and the installer with a trusted certificate and
   timestamp; verify signatures after packaging.
6. Publish the binary ZIP, installer, exact corresponding-source ZIP, SBOM,
   third-party notices, and SHA-256 checksums together.
7. Retain the source commit, toolchain/dependency locks, test results, paid and
   Evaluation evidence, signature verification, artifact hashes, legal-review
   version, and store configuration as the release record.

## 6. Launch/no-launch decision

Do not enable the live checkout until all items in
`docs/EXTERNAL_RELEASE_BLOCKERS.md` are signed off. A passing automated build is
necessary but does not resolve identity/KYC, code-signing trust, patent,
trademark, privacy, consumer-law, or independent open-source compliance review.

Primary references:

- https://docs.lemonsqueezy.com/api/license-api
- https://docs.lemonsqueezy.com/api/license-api/activate-license-key
- https://developers.cloudflare.com/workers/runtime-apis/bindings/rate-limit/
- https://www.qt.io/development-open-source-lgpl-obligations
