# Help4 Builder Suite Licensing + Update Delivery

## Free Public Channel

- The public package is free and does not require remote license validation.
- The only built-in remote channel is update metadata and package delivery from Help4 WordPress package hosts.
- Payment-router, catalog-feed, license API, and checkout endpoints are administrator-provided settings and should stay empty by default.
- Do not place billing-bridge credentials, router secrets, or package-signing secrets in web root.

## Versioned Releases (No latest.zip Dependency)

- Endpoint derives releases from secure config:
  - `updates.versions` map
- Effective latest version:
  - use `updates.current_version` only when key exists in `versions`
  - otherwise fallback to highest semver key

Mirror strategy per version (primary + mirror):

- `https://plugins.help4wordpress.com/help4-builder-suite/help4-builder-suite-x.y.z.zip`
- `https://plugin.help4wordpress.com/help4-builder-suite/help4-builder-suite-x.y.z.zip`
- `https://help4wordpress.com/help4-builder-suite/help4-builder-suite-x.y.z.zip`

Free channel latest ZIP path:

- `https://plugins.help4wordpress.com/help4-builder-suite/latest.zip`

## Zip Publication Model

- Build plugin zips locally into `dist/`.
- Upload versioned zips to both mirrors above.
- Endpoint serves metadata only; it does not build or stream ZIP files.
