Lottery Sambad Standalone Receiver v1.0.0
=========================================

Purpose
-------
Receives 1 PM, 6 PM and 8 PM Lottery Sambad result images and result text from Sambad.tv without WordPress.

Requirements
------------
- PHP 7.4 or newer (PHP 8.x recommended)
- HTTPS website recommended
- cURL recommended (allow_url_fopen fallback is supported)
- Writable data/ and results/ folders
- Sambad Live Result Pages Sender v9.7.4 or newer

Install
-------
1. Upload the folder "lottery-sambad-standalone-receiver" to the customer's hosting.
2. Open: https://CUSTOMER-DOMAIN/lottery-sambad-standalone-receiver/
3. Enter:
   - Sender Website URL (normally https://sambad.tv)
   - API Key supplied from Lottery Sender > Connect Website
   - Customer Homepage URL
   - Website Name
   - Receiver Folder URL
   - Receiver Admin Password
4. Click Connect Receiver.
5. The installer tries to add the required Sambad.tv Result Source credit to a simple writable index.html/index.htm/index.php homepage. A backup is created before modification.
6. If automatic credit installation is not possible, copy the Result Source HTML from the dashboard into the public homepage.
7. Confirm Result Source Status = Active.

Endpoints used by Sender
------------------------
/api/push.php?slot=1pm
/api/push.php?slot=6pm
/api/push.php?slot=8pm

Public Result JSON
------------------
/api/result.php?slot=1pm
/api/result.php?slot=6pm
/api/result.php?slot=8pm
Optional back date: &date=16-08-2026

Display embeds
--------------
/embed.php?slot=1pm&type=image
/embed.php?slot=1pm&type=text
/embed.php?slot=1pm&type=both
Change slot to 6pm or 8pm. Optional date=DD-MM-YYYY.

Security
--------
- Sender requests are authenticated with a 64-hex shared secret in X-LS-Secret.
- The shared secret is generated locally and is not displayed in the dashboard.
- data/ is blocked from direct web access on Apache and stores PHP-return files that emit nothing if accessed normally.
- Result uploads reject non-image content when MIME detection is available and enforce a 30 MB size cap.
- Keep the receiver admin password private.

Source Credit
-------------
The connected homepage must contain the stable marker data-ulsr-source="sambad-tv" and a clickable https://sambad.tv/ source link. Sender API-client delivery verifies this after the connection grace period. A hosting owner can always remove files they control; the enforcement mechanism is that future API delivery can be paused when required attribution is missing.
