docs(distribution): Steam is the only channel — the zip, winget and the Store are dead
The site said "Coming soon to Steam" while the app docs still said direct download plus winget primary with Steam parked. One of them had to move, and the creator's ruling is Steam exclusive: a free app on Steam with the paid edition as a Steam DLC, and the $10/month plan sold off-Steam by Polar. Records the constraint that shapes the code, not just the prose: - Steamworks requires in-app purchases to use the Steam Wallet (Microtransactions doc, quoted in commercial.md), so the monthly is *stated*, never *sold*, inside a Steam build; the lifetime is plain DLC bought on the store page and read with BIsDlcInstalled. - Entitlement is `steamDlcOwned || polarKeyValid`, both resolving to one OutputProfile. steam_api64.dll ships beside the exe and is a functional dependency, not the rejected "IP protection" native DLL — without it DLC ownership cannot be read. Launched without Steam, the app falls back to the free profile rather than refusing to start. - Signing is moot: Steam installs never meet SmartScreen. Artifact Signing stays on the shelf for the day a non-Steam download exists. Year-one fixed cost is ~$115. - The exe rename must land before the first depot upload — Steamworks warns about renaming a live exe. Distribution.md is rewritten to SteamPipe mechanics (publish output, depot, steamcmd, DLC wiring, clean-account purchase/refund test). product.md, decisions.md (a new "Steam exclusive" entry with every dead vector), TASKS.md (Steamworks entitlement row, Steam packaging row), ai.md, index.md and the TASK 48 banner follow. MyMistakes.md gains the Steam rules that cost real time today: installs skip SmartScreen, updates are free, the Wallet rule, and the recurring-billing caveat.
This commit is contained in:
+76
-60
@@ -3,7 +3,7 @@
|
||||
The single source of truth for what LlamaCasty charges, what a licence entitles, how it ships and
|
||||
what support it does and does not include. Read before any pricing, licensing, distribution,
|
||||
storefront, support or promo work. Cause of death for every retired path:
|
||||
[`decisions.md`](decisions.md). Release mechanics (build, zip, mirror, winget):
|
||||
[`decisions.md`](decisions.md). Release mechanics (build, depot, SteamPipe upload):
|
||||
[`Distribution.md`](../../Distribution.md).
|
||||
|
||||
## Model
|
||||
@@ -43,11 +43,24 @@ The cap is a pixel budget plus a frame rate, not the word "720p":
|
||||
(cancel, revoke, sign-out, channel switch) greys them again on the next refresh.
|
||||
- **Bitrate follows the profile** — a capped user is not offered a 1080p bitrate.
|
||||
|
||||
## Entitlement
|
||||
## Entitlement — two sources, one profile
|
||||
|
||||
**Polar is the merchant of record and the only source of truth.** It takes the money, remits
|
||||
VAT/GST, handles refunds and chargebacks, and holds the keys. **There is no server of ours in the
|
||||
loop** — no claim page, no callback endpoint, no key database.
|
||||
**Pro is `steamDlcOwned || polarKeyValid`.** Both resolve to the same `OutputProfile`; neither
|
||||
touches a feature. Fail closed: anything unresolved is the free tier.
|
||||
|
||||
### Steam (lifetime)
|
||||
|
||||
- **Steam owns the lifetime SKU.** `ISteamApps::BIsDlcInstalled(dlcAppId)` after `SteamAPI.Init`.
|
||||
It is a local check against Steam's own state — no server, no key, no lease.
|
||||
- **Steam down or not running** → free profile, with a line explaining why, never a refusal to
|
||||
start. A Steam build launched outside Steam is the common case for people who pin shortcuts.
|
||||
- **No licence key exists for the Steam SKU**, so nothing to paste, email or lose.
|
||||
|
||||
### Polar (monthly, sold off-Steam)
|
||||
|
||||
**Polar is the merchant of record and the only source of truth** for the monthly plan. It takes the
|
||||
money, remits VAT/GST, handles refunds and chargebacks, and holds the keys. **There is no server of
|
||||
ours in the loop** — no claim page, no callback endpoint, no key database.
|
||||
|
||||
- **Key** — `LCYT-` prefix; org `c05fb364-…` and the endpoints are in `CREDENTIALS.md`. No
|
||||
product is created yet.
|
||||
@@ -84,57 +97,51 @@ channel ID. That is accepted: the free tier is the defence, the licence is a lea
|
||||
determined crack buys little. Do not propose a signed token, a hardware fingerprint or a server
|
||||
to "fix" it.
|
||||
|
||||
## Channels
|
||||
## Channels — Steam only
|
||||
|
||||
**One artifact, several ways to get it.** A self-contained single-file `LlamaCasty.exe` plus the
|
||||
bundled `ffmpeg\` folder, zipped. No .NET install, no admin, no installer framework. Trimming
|
||||
stays off (WPF reflection), so expect ~110–150 MB.
|
||||
**Steam is the distributor.** One free app on the store, the paid edition as a Steam **DLC**, and
|
||||
no other vector: no direct download, no winget, no Scoop/Chocolatey, no Microsoft Store. The store
|
||||
page is the single authoritative source for the download, the stats and the reviews.
|
||||
|
||||
1. **Direct download** — `llamacasty.com` links the zip. **Binaries live in a second Gitea repo
|
||||
(`llamacasty-releases`), push-mirrored to a public GitHub repo**, so the source repo stays
|
||||
private and the handout repo contains nothing but a README, an issue template and the release
|
||||
assets. The mirror carries refs, not GitHub Release assets — the zip is uploaded with
|
||||
`gh release create`. Mechanics: [`Distribution.md`](../../Distribution.md).
|
||||
2. **winget — the primary install path.** Manifest in `microsoft/winget-pkgs`, `InstallerType:
|
||||
portable`, pinned SHA-256. That hash pin is the anti-tamper wall: the official channel delivers
|
||||
exactly the published artifact or fails. One `wingetcreate update` PR per release. Optional:
|
||||
Scoop and Chocolatey manifests over the same zip.
|
||||
3. **Steam — parked at $100.** Lifetime Pro as DLC only (Steam has no subscriptions), page public
|
||||
two weeks before release, 30% cut, and price parity with the site. It is the only channel with
|
||||
discovery *and* an install that never meets SmartScreen, and it updates itself — which is why it
|
||||
stays in the plan despite the cut.
|
||||
4. **Microsoft Store — parked, and now free.** Microsoft waived the **$19** individual developer
|
||||
fee (and removed the **$99** company fee in May 2026). It is the only storefront that bills a
|
||||
subscription natively *and* the only zero-cost route to a Microsoft-signed install with no
|
||||
SmartScreen warning, because Microsoft signs the MSIX. Bans self-updaters, so a Store build
|
||||
ships without one.
|
||||
- **Lifetime Pro = Steam DLC.** Bought on the **store page**; the app only reads ownership
|
||||
(`ISteamApps::BIsDlcInstalled` / `UserHasLicenseForApp`). No purchase flow in the app, no Steam
|
||||
Wallet code, nothing to reconcile.
|
||||
- **The $10/month plan is sold outside Steam** and is **never purchasable inside a Steam build**.
|
||||
Steamworks requires in-app purchases to go through the Steam Wallet — so the app *states* that
|
||||
monthly plans exist on the site and does not sell them. If the app ever grows a checkout for it,
|
||||
that is the policy violation.
|
||||
- **Boot shape:** the app ships `steam_api64.dll` beside the exe and calls `SteamAPI.Init`. That
|
||||
is a functional dependency, not the rejected "native helper DLL for IP protection" — Steam
|
||||
ownership cannot be checked without it. Launched without Steam running, the app must fall back to
|
||||
the **free profile** and say so, never refuse to start.
|
||||
- **Updates are Steam's.** The depot push is the update; the app keeps no updater and no version
|
||||
banner (the old "no self-updater" rule stays, for the same reason: it works differently).
|
||||
- **Portable mode is no longer a distributable.** `portable.txt` remains as a feature for anyone who
|
||||
copies the installed folder; it is not a delivery mechanism.
|
||||
- **Steam Direct** is **$100 per app**, recoupable after $1,000 adjusted gross revenue.
|
||||
- **Price parity:** if the lifetime is ever sold off-Steam, it may not be cheaper than the Steam
|
||||
price.
|
||||
|
||||
**Not channels, ever:** Patreon or any subscription platform of our own, paywalled early access,
|
||||
a paid beta, a Discord. Content is the funnel; the channel is only the checkout.
|
||||
**Not channels, ever:** direct download, winget/Chocolatey/Scoop, the Microsoft Store, Patreon or
|
||||
any subscription platform of our own, paywalled early access, a paid beta, a Discord. Content is
|
||||
the funnel; Steam is the checkout.
|
||||
|
||||
**Portable mode:** a `portable.txt` marker beside the exe keeps the layout DB and settings in
|
||||
`.\data\` instead of `%APPDATA%\ytLlive` — the USB-stick case, hung off `LayoutPathOverride`.
|
||||
It is the reason the zip survives even if Steam becomes the primary channel.
|
||||
**Support surfaces this creates:** the Steam store page's support contact, Steam **Announcements**
|
||||
for known issues and release notes, Steam Discussions left pinned and unread, and one public issue
|
||||
repo for bugs that survive the friction of needing an account.
|
||||
|
||||
## Signing — deferred until there is revenue
|
||||
## Signing — not needed for the Steam channel
|
||||
|
||||
- **Not bought at launch.** Artifact Signing is listed in the costs as **deferred**: it is paid for
|
||||
out of Pro revenue, and the trigger is **two subscribers**.
|
||||
- **What it actually buys:** a named publisher line, fewer antivirus false positives on a ~150 MB
|
||||
self-extracting exe, and tamper evidence for hand-downloaded zips. It does **not** remove the
|
||||
SmartScreen warning on day one — Microsoft deleted the EV instant-bypass in March 2024, so a new
|
||||
certificate has zero reputation and clears only with download volume.
|
||||
- **Azure Artifact Signing** (renamed from "Trusted Signing"), **$9.99/month Basic**, up to 5,000
|
||||
signatures, **requires a paid Azure subscription**. Individual identity validation exists and
|
||||
must be renewed before it expires; it is the slow (days-to-weeks) part, so start it *when the
|
||||
purchase is decided*, not before.
|
||||
- **Reputation accrues to the publisher, not the file.** Unsigned means the warning on **every**
|
||||
release, forever, because SmartScreen ties reputation to each file hash. Signing is the only exit
|
||||
from that per-release tax.
|
||||
- **The free alternative is the Store** (see Channels 4): a free developer account gets
|
||||
Microsoft-signed installs with no certificate of ours.
|
||||
- **No EV certificate, ever** — $400+/yr for what OV buys, and the bypass is gone.
|
||||
- Every signed release: same pass, SHA-256 in the winget manifest, licence ID visible in About.
|
||||
- **Steam installs never meet SmartScreen.** Valve's client delivers the files, so there is no
|
||||
browser download, no Mark-of-the-Web and no "unknown publisher" wall. The certificate that
|
||||
existed only to soften that wall has nothing to do.
|
||||
- **Artifact Signing** (renamed from "Trusted Signing") stays on the shelf: Azure Artifact
|
||||
Signing, $9.99/month Basic, requires a paid Azure subscription, individual identity validation
|
||||
is the slow part. Buy it the day a non-Steam download exists — the zip case, not this one.
|
||||
- **Never EV, never a certificate with an HSM.** Microsoft removed the EV SmartScreen instant-bypass
|
||||
in March 2024; it buys nothing.
|
||||
- **Steam does not sign our exe either** — it just never puts it through the browser gauntlet.
|
||||
Windows may still show a UAC prompt for the app; that is elevation, not publisher trust.
|
||||
|
||||
## Support
|
||||
|
||||
@@ -174,14 +181,19 @@ Cash cost **$0**; it is priced in support time and forgone list revenue.
|
||||
|---|---|
|
||||
| Domain | ~$15/yr |
|
||||
| Droplet | $0 — serves the existing site |
|
||||
| GitHub public repo (releases + issues), Gitea, winget, Scoop, Chocolatey | $0 |
|
||||
| Polar | 5% + 50¢ per sale → $10 nets $9.00, $400 nets $379.50 |
|
||||
| Azure Artifact Signing — **deferred** | $9.99/month (~$120/yr), bought at two subscribers |
|
||||
| Steam Direct (optional) | $100 once, recoupable after $1,000 AGR |
|
||||
| Microsoft Store (optional) | **$0** — the individual fee was waived |
|
||||
| Steam Direct | **$100 once**, recoupable after $1,000 AGR |
|
||||
| Steam revenue share | 30% on the lifetime DLC → $400 nets **$280** |
|
||||
| Polar | 5% + 50¢ per sale → $10 nets $9.00 (monthly only) |
|
||||
| Steamworks, public issue repo, Gitea | $0 |
|
||||
| Azure Artifact Signing — **not needed** | Steam installs don't meet SmartScreen |
|
||||
| Microsoft Store — **not used** | — |
|
||||
|
||||
Fixed year one ≈ **$15** while unsigned, ≈ **$135** once signing starts. **Break-even is two
|
||||
subscribers** (15 subscriber-months ≈ $135); one $400 lifetime sale covers nearly three years.
|
||||
Fixed year one ≈ **$115** (domain + Steam Direct, one time). The Steam cut is the price of not
|
||||
paying for a certificate, a storefront or an update path.
|
||||
|
||||
**Signing is now moot as a launch cost.** Steam installs never meet SmartScreen, so the certificate
|
||||
that existed only to soften that wall has no job. Artifact Signing stays on the shelf for the day a
|
||||
non-Steam download exists.
|
||||
|
||||
## Anti-piracy posture
|
||||
|
||||
@@ -190,9 +202,13 @@ pointless and a leak that is traceable — not an unbreakable binary.
|
||||
|
||||
- **The free tier is the real defence.** If the only delta is pixels above 921,600, a cracked
|
||||
build buys almost nothing and forfeits updates, support and the publisher's signature.
|
||||
- **Hash-pinned delivery, signed once revenue exists** — a patched build cannot arrive through
|
||||
winget, and a forged one is not signed as us. Until signing starts, the SHA-256 pin is the wall.
|
||||
- **Short leases** — a revoked or refunded key dies inside the grace window.
|
||||
- **Steam DRM is optional and not needed.** The DLC check is already the entitlement; adding
|
||||
Valve's DRM wrapper buys nothing a determined crack respects, and it can break an exe on a
|
||||
machine that never runs Steam.
|
||||
- **The distribution is not a handout.** Steam deliveries go through Valve's client and account, so
|
||||
there is no public zip for a mirror site to repackage, and no hash pin for us to maintain.
|
||||
- **Short leases** — a revoked or refunded Polar key dies inside the grace window; a refunded Steam
|
||||
DLC stops reporting ownership the next time Steam is asked.
|
||||
- **Licence ID in About** — a leaked build traces back to a purchase.
|
||||
|
||||
⛔ **Rejected, do not re-propose:** a native helper DLL for "IP protection", obfuscation, hardware
|
||||
|
||||
Reference in New Issue
Block a user