# DesiRyva AI — cPanel deployment pack

## Important status
This package contains the DesiRyva AI central application source and the separately packaged Salon and Gym source folders. It is a **staging/deployment package**, not proof of a completed production installation. No access to your cPanel account or hosting database was available for a live deployment test.

The Pharmacy Payables issue is understood: `pharmacy_supplier_payments` references `pharmacy_suppliers`, which is created in `database/pharmacy_purchases.sql`. The consolidated SQL currently places `pharmacy_payables.sql` before `pharmacy_purchases.sql`. Do not import the consolidated SQL into a live server until the migration order and all foreign keys have been validated.

## 1. Prepare cPanel
1. Log in to cPanel.
2. Open **MultiPHP Manager** and select PHP 8.2 or later for the target domain/subdomain.
3. In **Select PHP Version** / PHP Extensions, enable: `pdo_mysql`, `curl`, `openssl`, `mbstring`, `json`.
4. Enable HTTPS/SSL for the domain.
5. Create a staging subdomain if possible, e.g. `staging.yourdomain.com`.

## 2. Upload the application files
1. Open **File Manager**.
2. Open the document root for the staging subdomain (or `public_html/desiryva-ai`).
3. Upload this ZIP and extract it.
4. Ensure the PHP application files are directly inside the intended app folder. The ZIP contains the `desiryva-ai` project directory.
5. Do not upload the ZIP into a live production folder over an existing installation. Keep a copy of the previous site for rollback.

## 3. Create MySQL databases and user
In cPanel → **MySQL Database Wizard**:
1. Create a database for the central platform core.
2. Create a second database for shared business modules.
3. Create a MySQL user with a strong password.
4. Add that user to both databases and grant **ALL PRIVILEGES** on those two application databases only.
5. Record the exact cPanel-prefixed database names and username. cPanel often adds an account prefix, for example `cpuser_desiryva_core`.

The central application expects two database connections:
- Core: `config/database.php`
- Shared business: `config/business-database.php`

Salon and Gym are separate product source trees and are not yet unified with central login/database provisioning. Do not assume their schemas are part of the two central databases.

## 4. Configure private credentials
Inside `config/`:
1. Copy `database.example.php` to `database.php`.
2. Copy `business-database.example.php` to `business-database.php`.
3. Edit both files with the exact cPanel host, database name, username and password. Use the cPanel-provided MySQL host; do not assume it is `127.0.0.1`.
4. Copy `app-secret.example.php` to `app-secret.php`.
5. Generate a fresh 32-byte key on your computer with:
   `php -r "echo bin2hex(random_bytes(32)), PHP_EOL;"`
   Paste the 64-character hex output into `app-secret.php`. Keep a secure offline backup of this key. Do not send it to anyone.
6. Copy `app.cpanel.example.php` to `app.php` and replace `YOUR-DOMAIN.example` with the actual HTTPS domain/path.

The included `config/.htaccess` denies direct web access to config files. Keep it in place. Do not place credentials in public PHP pages or share them in screenshots.

## 5. Database import — STOP AND VERIFY FIRST
**Do not import `database/DESIRYVA_ALL_DATABASES_MASTER_INSTALL.sql` into cPanel as-is.**

Reasons:
- cPanel database names are normally account-prefixed, while the current consolidated SQL uses fixed names such as `desiryva_core` and `desiryva_business`.
- The master SQL contains `CREATE DATABASE` and `USE` statements that may not match the names created in cPanel.
- The Pharmacy Payables section currently appears before the supplier/purchase migration it depends on, causing the foreign-key error you encountered.
- The source package includes separate migrations and some must be applied in dependency order.

Before importing, make a backup of any existing server databases. Use a staging database first. The database migration set must be reconciled to the exact cPanel-prefixed database names and imported in dependency order. Do not drop existing tables or disable foreign-key checks to force an import.

## 6. Create the first Super Admin
Only after the core schema is correctly installed and the database connection works:
1. Visit `https://YOUR-DOMAIN.example/desiryva-ai/install.php`.
2. Create the first Super Admin with a strong password (at least 12 characters).
3. After setup succeeds, delete `install.php` from the server using File Manager.
4. Sign in through `login.php`.

If the database schema is not installed, the installer will show a database/table error. Do not keep retrying; capture the exact error and stop.

## 7. Security and operational checklist
- Confirm HTTPS works before using the app; `session_secure` is `true` in the cPanel template.
- Keep `config/`, `storage/private/`, backups and logs inaccessible from the public web.
- Keep `config/.htaccess` and `storage/.htaccess`.
- Do not expose `tools/`, backup files, SQL dumps or credentials publicly.
- Use least-privilege MySQL credentials; never use the MySQL root account.
- Configure cron jobs only after reviewing each task and the hosting provider's PHP CLI path.
- Take a full files + database backup before every migration.
- Test login, logout, role permissions, tenant/branch isolation, payment callbacks and backup restore on staging.

## 8. Included products and known integration boundary
- Central DesiRyva AI source.
- `products/DesiRyva_Salon_Spa/` — separate Salon & Spa app source.
- `products/RajsolTech_Gym_Sports_Club/` — separate Gym & Sports Club app source.

Salon and Gym are included as source packages, but are not yet connected to the central platform's shared login, tenant provisioning or shared database. Deploy them as separate applications only after their own database setup and acceptance tests.

## 9. What to send if you need help
Send screenshots of:
- cPanel PHP version/extensions (hide account identifiers if desired).
- The exact database names shown in MySQL Databases (you may obscure the account prefix).
- The full error message from the first failed migration.

Never send passwords, API keys, app encryption keys, or full database dumps containing real customer data.