After purchase
- Download ZIP from My Purchases after payment
- Install CMS and open Admin β Marketplace Pairing
- Enter mp_live_* and activate production domain
- Create kai_live_* in IuVeAI Settings β API Keys for AI
Genesis Travel CMS
Production Preview
v14.1.9
Paid product
One-time purchase
Self-hosted
Genesis Travel CMS Production v14.1.9 (14.1.9 β Update Center Stale-Cache Hardening & language translations update; includes IuVeAI API Alignment from 14.1.8, Update Notifications from 14.1.7, Cron Configuration & Verification Fixes from 14.1.6, Secure Update Trust from 14.1.5, Widget Runtime & Production Cleanup from 14.1.4, Guided Update Installation from 14.1.3, Admin Language Consistency from 14.1.2, Update Center Reliability from 14.1.1 and Telegram Distribution from 14.1.0) is a self-hosted tourism platform with full CRUD for tours, destinations and partners, CRM leads, Brand & Design Center, Users & Security, System Health, RSS feeds, Telegram Bot API distribution for published tours, and Marketplace Product Pairing v1.0. License uses mp_live_*; AI uses a separate kai_live_* key. Marketplace remains the single source of truth for purchase, domain activation and entitlement.
Price: 500 β¬ Β· One-time purchase Β· Self-hosted license
AI Demo
The mp_live_* Marketplace purchase key validates license, domain and entitlement β it does not authorize AI requests. IuVeAI requires a separate kai_live_* API key from IuVeAI Settings β API Keys. AI health is tested independently from license validation. AI availability depends on the customer's active IuVeAI API access and provider availability.
Capabilities
- mp_live_* β purchase key for license activate/validate/entitlement only
- kai_live_* β separate API key for IuVeAI chat/completions
- Pairing UI β LifecycleManager β PairingService β https://www.iuve.eu/api
- Secrets masked in admin; no keys exposed to public JavaScript
Usage examples
AI-generated demo outline. Screenshots/video may be placeholders until published.
Capabilities
- Tourism website β responsive public site with destinations, tours, partner offers and lead forms
- Full CRUD Tours/Destinations/Partners β create, edit, publish, prices, SEO and images
- CRM leads β statuses, priorities, follow-up, internal notes timeline and source tracking
- Brand & Design Center β brand identity, hero/OG media, colors, contacts and SEO
- Users & Security β admin users, roles and password management
- System Health β PHP, extensions, storage, HTTPS, DB, version and pairing diagnostics
- Widget Runtime & Consent β Enabled/Disabled toggle per embed; consent categories (Always active, Functional, Analytics, Marketing); ACTIVE / DISABLED / NOT CONFIGURED status; renders in HEAD, after BODY open, before footer and before BODY close; Analytics/Marketing load only after visitor consent
- Production Cleanup β no demo tours/destinations/partners on DB error; optional demo content disabled by default; removed fake contacts; fixed stale "Production v12" label; real email verification/reset links and new-password form
- Guided Update Installation β Update Center shows UPDATE AVAILABLE / READY TO INSTALL; yellow security-policy notice; install confirmation dialog with file backup, database backup, digital signature and SHA-256 verification; IuVeAI Update Assistant (summary, estimated install time, rollback support)
- Admin Language Consistency β language translations update across admin languages
- Update Center Reliability β invalid JSON diagnostics; up-to-date vs failure states; Sodium/OpenSSL preflight; install gated until newer signed manifest; IuVe Control Center sidebar item
- Telegram Distribution β auto/manual tour posts to channel/group via Bot API; test message; send backlog; image support
- RSS & feeds β published tours, hot deals, recommended tours, Merchant / Travel XML Feed preserved
- Marketplace Product Pairing β fixed endpoints; mp_live_*; Clear Local Pairing does not remote-release
- Self-hosted deployment β PHP/MySQL; migration 012; upgrade/rollback docs; JPEG/PNG/WebP uploads
- Security β CSRF, masked secrets, domain normalization, validation cache, last-known-good recovery
System requirements
- Server: Linux hosting recommended; Apache or Nginx; HTTPS required; writable storage/ and uploads/
- PHP 8.1+ (8.2 recommended): PDO, PDO MySQL, JSON, cURL, mbstring, OpenSSL, fileinfo, sessions
- Database: MySQL 8+ or MariaDB 10.4+ compatible; UTF8MB4 recommended
- Browser: current Chrome, Firefox, Edge or Safari
- Installation: domain or subdomain; DB credentials; mp_live_* purchase key; optional kai_live_* API key
Latest version
Documentation
Installation guide
Extract the ZIP to your site document root. Open /install.php and configure database and administrator. After install go to Admin β Marketplace Pairing: enter mp_live_* license key, activate normalized domain, validate license, check entitlement if needed, save kai_live_* and run Test AI.
Marketplace Product Pairing
Pairing is implemented inside the self-hosted CMS (not in iuve.eu seller admin). Canonical chain: Admin UI β MarketplacePairingLifecycleManager β MarketplacePairingService β IuVe Marketplace API (https://www.iuve.eu/api).
- Architecture v1.0: /static/marketplace/docs/MARKETPLACE_PAIRING_ARCHITECTURE_V1.md
- CMS operational task: /static/marketplace/docs/MARKETPLACE_PRODUCT_PAIRING_CMS_TASK.md
- API pairing agent: /static/marketplace/docs/MARKETPLACE_CMS_IUVE_API_PAIRING_AGENT.md
Domain activation & license validation
Use mp_live_* from My Purchases. Activate normalized production domain before validate/entitlement.
IuVeAI API pairing
Create kai_live_* in Settings β API Keys. Configure in CMS pairing screen separately from mp_live_*.
Post-install security
Remove or protect /install.php after setup. Enforce HTTPS. Restrict admin access.
Upgrade, backup & rollback
Back up files and database before upgrades. Roll back by restoring backup and previous package version.
Troubleshooting
Use Admin β Marketplace Pairing diagnostics. Verify outbound HTTPS to https://www.iuve.eu/api.
Compatibility
Open full pageEnvironment and integration requirements for self-hosted deployment.
| Component | Requirement | Status |
|---|---|---|
| PHP | 8.1 | Verified |
| PHP | 8.2 | Verified |
| PHP | 8.3 | Verified |
| MySQL | 8.x | Verified |
| MariaDB | 10.4+ | Verified |
| Apache | 2.4+ | Verified |
| Nginx | 1.18+ | Verified |
| LSAPI | LiteSpeed | Verified |
| Hosting | Shared hosting | Verified |
| Hosting | VPS / dedicated | Verified |
| Browsers | Chrome, Firefox, Edge, Safari (current) | Verified |
| Windows Server + IIS | β | Not certified |
| PostgreSQL | β | Not certified |
| PHP | 8.0 or below | Not certified |
Changelog
v14.1.9 β Genesis Travel CMS Production v14.1.9 β Update Center Stale-Cache Hardening
- Genesis Travel CMS v14.1.9 β Update Center Stale-Cache Hardening
- Language translations update
- Update Center: at install time the client now re-fetches and verifies a fresh update manifest immediately before installing; a stale manifest cache is refreshed automatically; false SIGNATURE_INVALID errors caused by a stale cache are eliminated; signature verification is not weakened β installation still requires a valid signature.
- Re-fetch + verify at install: a fresh HTTP GET of the live manifest overwrites the update_manifest_json cache and the signature is verified on the FRESH manifest against the trusted key registry; on a network failure it falls back to the cache but still verifies the signature.
- Auto-refresh stale cache: a manifest older than a short TTL, or whose version differs from the latest advertised version, is refreshed before preflight/install.
- Preflight signature verification: Check Compatibility computes signature status on a fresh manifest and adds a Signature verified item, so the UI never shows READY based on a stale/bad cache.
- Graceful bad-cache repair: an unverifiable cached manifest is auto-cleared and re-fetched instead of dead-ending on FAILED; verification is never bypassed.
- Version bumped to 14.1.9; changelog, release notes and SHA-256 checksums updated; syntax verified across all PHP files.
v14.1.8 β Genesis Travel CMS Production v14.1.8 β IuVeAI API Alignment
- Genesis Travel CMS v14.1.8 β IuVeAI API Alignment
- Language translations update
- IuVeAI base address is now fixed to https://www.iuve.eu/api.
- Chat endpoint corrected: /v1/chat/completions β /chat/completions.
- Orchestrator endpoint corrected: /v1/orchestrator β /orchestrator.
- Fixed the AI check in Marketplace Pairing.
- Added strict validation: HTTPS only; www.iuve.eu only; mandatory /api/ prefix.
- Improved IuVeAI error diagnostics without ever printing the API key.
- Fixed the incorrect fallback message claiming the API was not connected.
- With fallback disabled, a correct controlled 502 error is now returned.
- Version bumped to 14.1.8; changelog, release notes and SHA-256 checksums updated; syntax verified across all 61 PHP files.
v14.1.7 β Genesis Travel CMS Production v14.1.7 β Update Notifications
- Genesis Travel CMS v14.1.7 β Update Notifications
- Language translations update
- Update notifications: dashboard banner and menu badge when a new version is available; cached check via Update Center/cron; notification once per version; optional administrator email and Telegram notifications; notification only β installation still passes signature verification.
v14.1.6 β Genesis Travel CMS Production v14.1.6 β Cron Configuration & Verification Fixes
- Genesis Travel CMS v14.1.6 β Cron Configuration & Verification Fixes
- Language translations update
- Full Cron configuration: new Cron Configuration section in IuVe Control Center β Diagnostics with automatic secure token generation, ready-to-use scheduler URL, interval choice (5/10/15/30/60 min), last run time + status + duration, states PASS / STALE / WAITING FOR FIRST RUN / NOT CONFIGURED, safe token rotation, a unified cron-health.php endpoint and cron run logging.
- Signature Verification fix: removed uninformative "β" values, shows "Waiting for update check" before verification, recognizes different Marketplace manifest formats (key_id, signing_key_id, signature_algorithm, nested signing object, signature_meta, structured signature object), shows a clear warning on an incomplete manifest; installation is still blocked if the signature cannot be verified.
- External Widgets & Code fix: display scope (Homepage only / All public pages), clear states ACTIVE / WAITING FOR CONSENT / DISABLED / NOT CONFIGURED, explains when code is hidden due to cookie consent, a button to open the homepage for testing, recommends Before Footer slot + Homepage only + correct consent category for a visual HTML block, and preserves unescaped HTML/CSS/JS output on the public side.
- Update safety: version bumped to 14.1.6, RU + EN release notes, CHANGELOG.md updated, FILES_SHA256.txt rebuilt, PHP lint passed and ZIP integrity checked; database config, IuVe Identity, license, uploads, storage and all custom and existing data are protected on update.
v14.1.5 β Genesis Travel CMS Production v14.1.5 β Secure Update Trust
- Genesis Travel CMS v14.1.5 β Secure Update Trust
- Language translations update
- Secure Update Trust: trusted update key registry (Root Trust Key + Marketplace release signing keys), key_id in manifest, multi-key support, key revocation, signature verification log in IuVe Control Center.
- Trusted update key registry (config/update_trust.php) shipped in the package so future installs/updates always carry the Marketplace public key and can never regress to an empty update key.
- Update Center verifies each signed release against the trusted registry (active + validity window + algorithm), with backward-compatible fallback to the legacy single update_public_key.
- Marketplace, IuVe Identity, licensing, RSS and Telegram Distribution were NOT changed
v14.1.4 β Genesis Travel CMS Production v14.1.4 β Widget Runtime & Production Cleanup
- Genesis Travel CMS v14.1.4 β Widget Runtime & Production Cleanup
- Language translations update
- Added explicit Enabled / Disabled toggle instead of unclear checkbox
- Each embed placement now sets a consent category: Always active; Functional; Analytics; Marketing
- Admin shows real state of each block: ACTIVE; DISABLED; NOT CONFIGURED
- Code renders correctly in all four placements: HEAD; after BODY open; before footer; before BODY close
- Added hint that Analytics and Marketing appear only after visitor consent
- Removed automatic output of demo tours, destinations and partners on database error
- Demo content on install is now optional and disabled by default
- Removed fake contacts: travel@example.com; +373 00 000 000
- Fixed stale "Production v12" label
- Removed demo password-reset links on frontend
- Added sending of verification/reset links via email
- Added a real new-password form
- Marketplace, Update Center, Telegram, RSS, IuVe Identity and licensing were NOT changed
v14.1.3 β Genesis Travel CMS Production v14.1.3 β Guided Update Installation
- Genesis Travel CMS v14.1.3 β Guided Update Installation
- Language translations update
- INSTALL_DISABLED no longer puts Update Center into FAILED state
- When a version is found, shows UPDATE AVAILABLE
- After successful preflight, shows READY TO INSTALL
- Technical message replaced with a clear yellow security-policy notice
- "Install Update" button active when a new version is available
- Added install confirmation dialog with mandatory steps: file backup, database backup, digital signature verification, SHA-256 verification; dialog confirmation explicitly authorizes signed installation
- Added IuVeAI Update Assistant block: update summary, estimated install time, rollback support info
- Marketplace API, IuVe Identity, licensing, RSS, Telegram Distribution, and tour business logic were NOT changed
v14.1.2 β Genesis Travel CMS Production v14.1.2 β Admin Language Consistency
- Genesis Travel CMS v14.1.2 β Admin Language Consistency
- Language translations update (Admin Language Consistency)
v14.1.1 β Genesis Travel CMS Production v14.1.1 β Update Center Reliability
- Genesis Travel CMS v14.1.1 β Update Center Reliability & IuVe Navigation
- Added detailed invalid JSON diagnostics for Marketplace responses
- Distinguished up-to-date state from actual update failures
- Fixed preflight crypto capability check to accept Sodium or OpenSSL
- Disabled install/preflight actions when no newer signed manifest is available
- Added a dedicated highlighted IuVe Control Center item in the admin sidebar
- Preserved Telegram Distribution, RSS feeds, Identity, Marketplace Pairing and IuVeAI
v14.1.0 β Genesis Travel CMS Production v14.1.0 β Telegram Distribution
- Genesis Travel CMS v14.1.0 β Telegram Distribution
- Preserved RSS module: general published tours RSS, hot deals RSS, recommended tours RSS, Merchant / Travel XML Feed
- Telegram Bot API: send newly published tour to Telegram channel or group
- Auto-send when tour status changes to published; manual Telegram button near published tour
- Send all previously unsent offers; test message for connection check; tour image support
- Tour fields in Telegram post: name, destination, hotel, nights, departure city, meal plan, price, description, tour link
- Log of successful and failed sends; duplicate publish protection; secured cron URL
- Bot Token and Channel/Group ID configuration in Marketing & Feeds admin
- Setup: create bot via BotFather β add bot to channel/group β grant publish rights (channels) β enter Bot Token + channel/group ID β Send Test Message β enable Automatically publish a tour
- Identity + Marketplace Pairing retained; mp_live_* license vs kai_live_* AI keys remain separate
v14.0.1 β Genesis Travel CMS Production v14.0.1
- Marketplace download artifact restored at releases/marketplace-artifacts/genesis-travel-cms-v14.0.1.zip
- Identity + Marketplace Pairing retained; mp_live_* license vs kai_live_* AI keys remain separate
- Update Centerβready self-hosted package tip set to 14.0.1
v12.0.0 β Genesis Travel CMS Production v12
- Full CRUD for Tours, Destinations and Partners (replaces production stubs)
- CRM leads with statuses, priorities, follow-up and note timeline
- Brand & Design Center with media upload and SEO fields
- Users & Security and System Health admin modules
- MarketplacePairingService + MarketplacePairingLifecycleManager (canonical pairing chain)
- Marketplace endpoints fixed via allowlist; removed from editable admin forms
- Strict mp_live_* (license) vs kai_live_* (AI) separation; key masking; CSRF; audit
- 15-minute validation cache and last-known-good recovery
- Safe JPEG/PNG/WebP uploads; adaptive admin shell
- Migration 012_production_v12.sql and production upgrade/rollback docs
v1.0.2 β Marketplace paid product & Pairing v1.0.2
- Converted Marketplace product from free to paid
- Set one-time price to β¬500
- Connected existing Marketplace checkout and purchase flow
- Added paid-entitlement download protection
- Added mp_live_* license issuance after successful purchase
- Updated Marketplace Product Pairing information
- Clarified separation of mp_live_* and kai_live_*
- Updated product details, requirements and compatibility
- Improved pairing diagnostics and security documentation
- Removed obsolete free-product wording
Screenshots
