# .env Migration Checklist

Use this to map legacy `dewemoji-live-backend/public_html/config/env.php` into NativePHP app `app/.env`.

## 1) Local development (safe default)

```env
APP_ENV=local
APP_DEBUG=true
APP_URL=http://127.0.0.1:8000

DB_CONNECTION=sqlite

DEWEMOJI_BILLING_MODE=sandbox
DEWEMOJI_LICENSE_ACCEPT_ALL=false
DEWEMOJI_PRO_KEYS=

DEWEMOJI_ALLOWED_ORIGINS=http://127.0.0.1:8000,http://localhost:8000
DEWEMOJI_FRONTEND_HEADER=web-v1
DEWEMOJI_FREE_DAILY_LIMIT=30

DEWEMOJI_GUMROAD_ENABLED=false
DEWEMOJI_MAYAR_ENABLED=false
```

## 2) Staging (real provider test)

```env
APP_ENV=staging
APP_DEBUG=false
APP_URL=https://staging.your-domain.com

DB_CONNECTION=mysql
DB_HOST=127.0.0.1
DB_PORT=3306
DB_DATABASE=dewemojiAPI_DB
DB_USERNAME=...
DB_PASSWORD=...

DEWEMOJI_BILLING_MODE=live
DEWEMOJI_LICENSE_ACCEPT_ALL=false
DEWEMOJI_PRO_KEYS=

DEWEMOJI_ALLOWED_ORIGINS=https://staging.your-domain.com,https://dewemoji.com,https://www.dewemoji.com,https://emoji.dewe.pw
DEWEMOJI_FRONTEND_HEADER=web-v1
DEWEMOJI_FREE_DAILY_LIMIT=30

DEWEMOJI_GUMROAD_ENABLED=true
DEWEMOJI_GUMROAD_VERIFY_URL=https://api.gumroad.com/v2/licenses/verify
DEWEMOJI_GUMROAD_PRODUCT_IDS=qfvcuT7RwcDn5Oi4KQcOBQ==,t8Kq1G5wzrd1KcYOgukpzw==

DEWEMOJI_MAYAR_ENABLED=true
DEWEMOJI_MAYAR_API_BASE=https://api.mayar.id
DEWEMOJI_MAYAR_ENDPOINT_VERIFY=/v1/license/verify
DEWEMOJI_MAYAR_SECRET_KEY=...
```

## 3) Production

```env
APP_ENV=production
APP_DEBUG=false
APP_URL=https://dewemoji.com

DB_CONNECTION=mysql
DB_HOST=127.0.0.1
DB_PORT=3306
DB_DATABASE=dewemojiAPI_DB
DB_USERNAME=...
DB_PASSWORD=...

DEWEMOJI_BILLING_MODE=live
DEWEMOJI_LICENSE_ACCEPT_ALL=false
DEWEMOJI_PRO_KEYS=

DEWEMOJI_ALLOWED_ORIGINS=https://dewemoji.com,https://www.dewemoji.com
DEWEMOJI_FRONTEND_HEADER=web-v1
DEWEMOJI_FREE_DAILY_LIMIT=30

DEWEMOJI_GUMROAD_ENABLED=true
DEWEMOJI_GUMROAD_VERIFY_URL=https://api.gumroad.com/v2/licenses/verify
DEWEMOJI_GUMROAD_PRODUCT_IDS=qfvcuT7RwcDn5Oi4KQcOBQ==,t8Kq1G5wzrd1KcYOgukpzw==

DEWEMOJI_MAYAR_ENABLED=true
DEWEMOJI_MAYAR_API_BASE=https://api.mayar.id
DEWEMOJI_MAYAR_ENDPOINT_VERIFY=/v1/license/verify
DEWEMOJI_MAYAR_SECRET_KEY=...
```

## 4) Legacy -> NativePHP key map

- `gateway_mode` -> `DEWEMOJI_BILLING_MODE`
- `allowed_origins[]` -> `DEWEMOJI_ALLOWED_ORIGINS` (comma-separated)
- `frontend_header` -> `DEWEMOJI_FRONTEND_HEADER`
- `free_daily_limit` -> `DEWEMOJI_FREE_DAILY_LIMIT`
- `gumroad.product_ids[]` -> `DEWEMOJI_GUMROAD_PRODUCT_IDS` (comma-separated)
- `gumroad.verify_url` -> `DEWEMOJI_GUMROAD_VERIFY_URL`
- `mayar.api_base` -> `DEWEMOJI_MAYAR_API_BASE`
- `mayar.endpoint_verify` -> `DEWEMOJI_MAYAR_ENDPOINT_VERIFY`
- `mayar.secret_key` -> `DEWEMOJI_MAYAR_SECRET_KEY`

## 5) Final checks

1. Run: `php artisan config:clear`
2. Run: `php artisan migrate --force`
3. Test verify endpoint with real key (Gumroad and Mayar)
4. Confirm `/v1/license/activate` + `/v1/license/deactivate`
5. Confirm frontend pages: `/`, `/browse`, `/support`, `/pricing`, `/api-docs`

## 6) Security note

Legacy `env.php` contains exposed secrets. Rotate all production credentials before final cutover:
- DB password
- Mayar key
- Turnstile keys
- OpenRouter key
- Redis password