updates

rsync-studio-licensing/.env.example

@@ -72,6 +72,16 @@ RSYNC_STUDIO_DEFAULT_MAX_MAJOR_VERSION=1
 RSYNC_STUDIO_PURCHASE_URL=
 RSYNC_STUDIO_PORTAL_URL=
 RSYNC_STUDIO_SUPPORT_URL=
+PADDLE_API_KEY=
+PADDLE_API_URL=https://sandbox-api.paddle.com
+PADDLE_CLIENT_SIDE_TOKEN=
+PADDLE_ENVIRONMENT=sandbox
 PADDLE_WEBHOOK_SECRET=
 PADDLE_WEBHOOK_TOLERANCE=300
+PADDLE_PERSONAL_PRODUCT_ID=
+PADDLE_PERSONAL_MONTHLY_PRICE_ID=
+PADDLE_PERSONAL_ANNUAL_PRICE_ID=
+PADDLE_PROFESSIONAL_PRODUCT_ID=
+PADDLE_PROFESSIONAL_MONTHLY_PRICE_ID=
+PADDLE_PROFESSIONAL_ANNUAL_PRICE_ID=
 LEMON_SQUEEZY_WEBHOOK_SECRET=

rsync-studio-licensing/app/Console/Commands/RsyncStudioAdminCreate.php

@@ -1,10 +1,36 @@
 <?php
+
 namespace App\Console\Commands;
+
 use App\Models\User;
 use Illuminate\Console\Command;
 use Illuminate\Support\Facades\Hash;
 use Illuminate\Support\Str;
-final class RsyncStudioAdminCreate extends Command {
- protected $signature='rsync-studio:admin {email} {--name=Administrator}'; protected $description='Create or promote an Rsync Studio licensing administrator';
- public function handle(): int { $email=strtolower(trim($this->argument('email'))); $password=Str::password(24,true,true,false,false); $u=User::firstOrNew(['email'=>$email]); $u->name=$this->option('name'); $u->is_admin=true; $u->email_verified_at=now(); if(!$u->exists){$u->password=Hash::make($password);} $u->save(); $this->info("Administrator ready: {$email}"); if(!$u->wasRecentlyCreated){$this->line('Existing password retained.');}else{$this->warn("Temporary password (shown once): {$password}");} return self::SUCCESS; }
+
+final class RsyncStudioAdminCreate extends Command
+{
+    protected $signature = 'rsync-studio:admin {email} {--name=Administrator}';
+
+    protected $description = 'Create or promote an Rsync Studio licensing administrator';
+
+    public function handle(): int
+    {
+        $email = strtolower(trim($this->argument('email')));
+        $password = Str::password(24, true, true, false, false);
+        $u = User::firstOrNew(['email' => $email]);
+        $u->name = $this->option('name');
+        $u->is_admin = true;
+        $u->email_verified_at = now();
+        if (! $u->exists) {
+            $u->password = Hash::make($password);
+        } $u->save();
+        $this->info("Administrator ready: {$email}");
+        if (! $u->wasRecentlyCreated) {
+            $this->line('Existing password retained.');
+        } else {
+            $this->warn("Temporary password (shown once): {$password}");
+        }
+
+return self::SUCCESS;
+    }
 }

rsync-studio-licensing/app/Console/Commands/RsyncStudioLicenseIssue.php

@@ -1,10 +1,29 @@
 <?php
+
 namespace App\Console\Commands;
+
 use App\Models\LicenseProduct;
 use App\Services\Licensing\LicenseIssuer;
 use Illuminate\Console\Command;
+
 class RsyncStudioLicenseIssue extends Command
 {
-    protected $signature='rsync-studio:license:issue {product} {--name=} {--email=}'; protected $description='Issue a manual Rsync Studio licence key';
-    public function handle(LicenseIssuer $issuer): int { $p=LicenseProduct::where('code',$this->argument('product'))->firstOrFail(); [$l,$key]=$issuer->issue($p,$this->option('name')?:null,$this->option('email')?:null); if(!$key){$this->warn('Licence already existed; plaintext key is intentionally not recoverable.');return self::FAILURE;} $this->line('Licence ID: '.$l->id);$this->line('Licence key: '.$key);$this->warn('This is the only time the plaintext key is shown.');return self::SUCCESS; }
+    protected $signature = 'rsync-studio:license:issue {product} {--name=} {--email=}';
+
+    protected $description = 'Issue a manual Rsync Studio licence key';
+
+    public function handle(LicenseIssuer $issuer): int
+    {
+        $p = LicenseProduct::where('code', $this->argument('product'))->firstOrFail();
+        [$l,$key] = $issuer->issue($p, $this->option('name') ?: null, $this->option('email') ?: null);
+        if (! $key) {
+            $this->warn('Licence already existed; plaintext key is intentionally not recoverable.');
+
+            return self::FAILURE;
+        } $this->line('Licence ID: '.$l->id);
+        $this->line('Licence key: '.$key);
+        $this->warn('This is the only time the plaintext key is shown.');
+
+        return self::SUCCESS;
+    }
 }

rsync-studio-licensing/app/Console/Commands/RsyncStudioLicenseRevoke.php

@@ -1,9 +1,22 @@
 <?php
+
 namespace App\Console\Commands;
+
 use App\Models\License;
 use Illuminate\Console\Command;
+
 class RsyncStudioLicenseRevoke extends Command
 {
-    protected $signature='rsync-studio:license:revoke {id} {--reason=Administrative revocation}'; protected $description='Revoke a Rsync Studio licence';
-    public function handle(): int { $l=License::findOrFail($this->argument('id'));$l->update(['revoked_at'=>now(),'revoke_reason'=>$this->option('reason')]);$this->info('Licence revoked.');return self::SUCCESS; }
+    protected $signature = 'rsync-studio:license:revoke {id} {--reason=Administrative revocation}';
+
+    protected $description = 'Revoke a Rsync Studio licence';
+
+    public function handle(): int
+    {
+        $l = License::findOrFail($this->argument('id'));
+        $l->update(['revoked_at' => now(), 'revoke_reason' => $this->option('reason')]);
+        $this->info('Licence revoked.');
+
+        return self::SUCCESS;
+    }
 }

rsync-studio-licensing/app/Console/Commands/RsyncStudioProductCreate.php

@@ -1,10 +1,21 @@
 <?php
+
 namespace App\Console\Commands;
+
 use App\Models\LicenseProduct;
 use Illuminate\Console\Command;
+
 class RsyncStudioProductCreate extends Command
 {
-    protected $signature='rsync-studio:product {code} {--name=Rsync Studio} {--edition=Professional} {--activations=1} {--max-major=1} {--provider=} {--product-id=} {--price-id=}';
-    protected $description='Create or update a Rsync Studio licensing product';
-    public function handle(): int { $p=LicenseProduct::updateOrCreate(['code'=>$this->argument('code')],['name'=>$this->option('name'),'edition'=>$this->option('edition'),'activation_limit'=>(int)$this->option('activations'),'max_major_version'=>$this->option('max-major')!==''?(int)$this->option('max-major'):null,'payment_provider'=>$this->option('provider')?:null,'external_product_id'=>$this->option('product-id')?:null,'external_price_id'=>$this->option('price-id')?:null,'active'=>true]); $this->info("Product {$p->code} ready."); return self::SUCCESS; }
+    protected $signature = 'rsync-studio:product {code} {--name=Rsync Studio} {--edition=Professional} {--activations=1} {--max-major=1} {--provider=} {--product-id=} {--price-id=}';
+
+    protected $description = 'Create or update a Rsync Studio licensing product';
+
+    public function handle(): int
+    {
+        $p = LicenseProduct::updateOrCreate(['code' => $this->argument('code')], ['name' => $this->option('name'), 'edition' => $this->option('edition'), 'activation_limit' => (int) $this->option('activations'), 'max_major_version' => $this->option('max-major') !== '' ? (int) $this->option('max-major') : null, 'payment_provider' => $this->option('provider') ?: null, 'external_product_id' => $this->option('product-id') ?: null, 'external_price_id' => $this->option('price-id') ?: null, 'active' => true]);
+        $this->info("Product {$p->code} ready.");
+
+        return self::SUCCESS;
+    }
 }

rsync-studio-licensing/app/Http/Controllers/Admin/AdminController.php

@@ -1,14 +1,49 @@
 <?php
+
 namespace App\Http\Controllers\Admin;
+
 use App\Http\Controllers\Controller;
 use App\Models\License;
-use App\Models\LicenseProduct;
+use App\Models\LicenseActivation;
 use App\Models\User;
 use Illuminate\Http\Request;
-final class AdminController extends Controller {
- public function index(){ return view('admin.index',['licenseCount'=>License::count(),'activeCount'=>License::whereNull('revoked_at')->count(),'activationCount'=>\App\Models\LicenseActivation::whereNull('deactivated_at')->count(),'userCount'=>User::count()]); }
- public function licenses(Request $r){ $q=License::with('product')->latest(); if($s=trim((string)$r->query('q'))) $q->where(fn($x)=>$x->where('customer_email','like',"%{$s}%")->orWhere('customer_name','like',"%{$s}%")->orWhere('license_key_last4','like',"%{$s}%")); return view('admin.licenses',['licenses'=>$q->paginate(50)->withQueryString()]); }
- public function show(License $license){$license->load(['product','activations']); return view('admin.license',compact('license'));}
- public function revoke(Request $request,License $license){$data=$request->validate(['reason'=>['nullable','string','max:255']]);$license->update(['revoked_at'=>now(),'revoke_reason'=>$data['reason']?:'Revoked by administrator']);return back()->with('status','Licence revoked.');}
- public function restore(License $license){$license->update(['revoked_at'=>null,'revoke_reason'=>null]);return back()->with('status','Licence restored.');}
+
+final class AdminController extends Controller
+{
+    public function index()
+    {
+        return view('admin.index', ['licenseCount' => License::count(), 'activeCount' => License::whereNull('revoked_at')->count(), 'activationCount' => LicenseActivation::whereNull('deactivated_at')->count(), 'userCount' => User::count()]);
+    }
+
+    public function licenses(Request $r)
+    {
+        $q = License::with('product')->latest();
+        if ($s = trim((string) $r->query('q'))) {
+            $q->where(fn ($x) => $x->where('customer_email', 'like', "%{$s}%")->orWhere('customer_name', 'like', "%{$s}%")->orWhere('license_key_last4', 'like', "%{$s}%"));
+        }
+
+return view('admin.licenses', ['licenses' => $q->paginate(50)->withQueryString()]);
+    }
+
+    public function show(License $license)
+    {
+        $license->load(['product', 'activations']);
+
+        return view('admin.license', compact('license'));
+    }
+
+    public function revoke(Request $request, License $license)
+    {
+        $data = $request->validate(['reason' => ['nullable', 'string', 'max:255']]);
+        $license->update(['revoked_at' => now(), 'revoke_reason' => $data['reason'] ?: 'Revoked by administrator']);
+
+        return back()->with('status', 'Licence revoked.');
+    }
+
+    public function restore(License $license)
+    {
+        $license->update(['revoked_at' => null, 'revoke_reason' => null]);
+
+        return back()->with('status','Licence restored.');
+    }
 }

rsync-studio-licensing/app/Http/Controllers/Admin/SupportTicketController.php

@@ -0,0 +1,59 @@
+<?php
+
+namespace App\Http\Controllers\Admin;
+
+use App\Http\Controllers\Controller;
+use App\Models\SupportTicket;
+use App\Models\User;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+
+final class SupportTicketController extends Controller
+{
+    public function index(Request $request)
+    {
+        $tickets = SupportTicket::query()
+            ->with('assignee')
+            ->when($request->filled('status'), fn ($q) => $q->where('status', $request->string('status')))
+            ->latest()
+            ->paginate(50)
+            ->withQueryString();
+
+        return view('admin.support.index', compact('tickets'));
+    }
+
+    public function show(SupportTicket $ticket)
+    {
+        $ticket->load(['user', 'assignee']);
+        if (auth()->user()) {
+            auth()->user()->unreadNotifications()->get()
+                ->filter(fn ($notification) => (int) ($notification->data['support_ticket_id'] ?? 0) === $ticket->id)
+                ->each->markAsRead();
+        }
+
+        return view('admin.support.show', [
+            'ticket' => $ticket,
+            'admins' => User::query()->where('is_admin', true)->orderBy('name')->get(['id', 'name', 'email']),
+        ]);
+    }
+
+    public function update(Request $request, SupportTicket $ticket): RedirectResponse
+    {
+        $data = $request->validate([
+            'status' => ['required', 'in:new,open,waiting,resolved,closed'],
+            'priority' => ['required', 'in:low,normal,high,urgent'],
+            'assigned_to' => ['nullable', 'integer', 'exists:users,id'],
+        ]);
+
+        if ($data['assigned_to'] ?? null) {
+            abort_unless(User::whereKey($data['assigned_to'])->where('is_admin', true)->exists(), 422);
+        }
+
+        $data['resolved_at'] = in_array($data['status'], ['resolved', 'closed'], true)
+            ? ($ticket->resolved_at ?? now())
+            : null;
+        $ticket->update($data);
+
+        return back()->with('status', 'Support ticket updated.');
+    }
+}

rsync-studio-licensing/app/Http/Controllers/Api/LicenseActivationController.php

@@ -1,4 +1,5 @@
 <?php
+
 namespace App\Http\Controllers\Api;
 
 use App\Http\Controllers\Controller;
@@ -17,37 +18,147 @@ final class LicenseActivationController extends Controller
     public function activate(Request $request, LicenseSigner $signer): JsonResponse
     {
         $data = $request->validate([
-            'licenseKey'=>['required','string','max:128'],
-            'installationID'=>['required','uuid'],
-            'appVersion'=>['required','string','max:32'],
-            'platform'=>['required','string','max:32'],
+            'licenseKey' => ['required', 'string', 'max:128'],
+            'installationID' => ['required', 'uuid'],
+            'appVersion' => ['required', 'string', 'max:32'],
+            'platform' => ['required', 'string', 'max:32'],
         ]);
 
-        return DB::transaction(function () use ($data,$signer) {
-            $license = License::where('license_key_hash', LicenseKey::hash($data['licenseKey']))->lockForUpdate()->first();
-            if (!$license) throw ValidationException::withMessages(['licenseKey'=>'The licence key is not valid.']);
-            if (!$license->is_usable) return response()->json(['message'=>'This licence is expired or has been revoked.'], 403);
+        return DB::transaction(function () use ($data, $signer) {
+            $license = License::where('license_key_hash', LicenseKey::hash($data['licenseKey']))
+                ->lockForUpdate()
+                ->first();
 
-            $activation = LicenseActivation::where('license_id',$license->id)->where('installation_id',strtolower($data['installationID']))->first();
-            if ($activation && $activation->deactivated_at === null) {
-                $activation->update(['last_seen_at'=>now(),'platform'=>$data['platform'],'app_version'=>$data['appVersion']]);
-            } else {
-                $activeCount = LicenseActivation::where('license_id',$license->id)->whereNull('deactivated_at')->count();
-                if ($activeCount >= $license->activation_limit) return response()->json(['message'=>'This licence has reached its activation limit. Deactivate another Mac first.'], 409);
-                if ($activation) $activation->update(['deactivated_at'=>null,'activated_at'=>now(),'last_seen_at'=>now(),'platform'=>$data['platform'],'app_version'=>$data['appVersion']]);
-                else LicenseActivation::create(['license_id'=>$license->id,'installation_id'=>strtolower($data['installationID']),'platform'=>$data['platform'],'app_version'=>$data['appVersion'],'activated_at'=>now(),'last_seen_at'=>now()]);
+            if (! $license) {
+                throw ValidationException::withMessages(['licenseKey' => 'The licence key is not valid.']);
             }
-            return response()->json(['licenseToken'=>$signer->sign($license, $data['installationID'])]);
+
+            if (! $license->is_usable) {
+                return response()->json(['message' => 'This licence is expired or has been revoked.'], 403);
+            }
+
+            $installationID = strtolower($data['installationID']);
+            $activation = LicenseActivation::where('license_id', $license->id)
+                ->where('installation_id', $installationID)
+                ->first();
+
+            if ($activation && $activation->deactivated_at === null) {
+                $activation->update([
+                    'last_seen_at' => now(),
+                    'platform' => $data['platform'],
+                    'app_version' => $data['appVersion'],
+                ]);
+            } else {
+                $activeCount = LicenseActivation::where('license_id', $license->id)
+                    ->whereNull('deactivated_at')
+                    ->count();
+
+                if ($activeCount >= $license->activation_limit) {
+                    return response()->json(['message' => 'This licence has reached its activation limit. Deactivate another Mac first.'], 409);
+                }
+
+                if ($activation) {
+                    $activation->update([
+                        'deactivated_at' => null,
+                        'activated_at' => now(),
+                        'last_seen_at' => now(),
+                        'platform' => $data['platform'],
+                        'app_version' => $data['appVersion'],
+                    ]);
+                } else {
+                    LicenseActivation::create([
+                        'license_id' => $license->id,
+                        'installation_id' => $installationID,
+                        'platform' => $data['platform'],
+                        'app_version' => $data['appVersion'],
+                        'activated_at' => now(),
+                        'last_seen_at' => now(),
+                    ]);
+                }
+            }
+
+            return response()->json([
+                'licenseToken' => $signer->sign($license, $data['installationID']),
+            ]);
+        });
+    }
+
+    public function validateInstallation(
+        Request $request,
+        LicenseTokenVerifier $verifier,
+        LicenseSigner $signer,
+    ): JsonResponse {
+        $data = $request->validate([
+            'licenseToken' => ['required', 'string', 'max:8192'],
+            'installationID' => ['required', 'uuid'],
+            'appVersion' => ['required', 'string', 'max:32'],
+            'platform' => ['required', 'string', 'max:32'],
+        ]);
+
+        try {
+            $payload = $verifier->verify($data['licenseToken']);
+        } catch (\Throwable) {
+            return response()->json(['message' => 'The licence token is invalid.'], 400);
+        }
+
+        if (strcasecmp((string) ($payload['installationID'] ?? ''), $data['installationID']) !== 0) {
+            return response()->json(['message' => 'The installation does not match this licence token.'], 400);
+        }
+
+        return DB::transaction(function () use ($data, $payload, $signer) {
+            $license = License::whereKey((string) ($payload['licenseID'] ?? ''))
+                ->lockForUpdate()
+                ->first();
+
+            if (! $license || ! $license->is_usable) {
+                return response()->json(['message' => 'This licence is expired or has been revoked.'], 403);
+            }
+
+            $activation = LicenseActivation::where('license_id', $license->id)
+                ->where('installation_id', strtolower($data['installationID']))
+                ->first();
+
+            if (! $activation || $activation->deactivated_at !== null) {
+                return response()->json(['message' => 'This Mac has been deactivated from the licence portal.'], 403);
+            }
+
+            $activation->update([
+                'last_seen_at' => now(),
+                'platform' => $data['platform'],
+                'app_version' => $data['appVersion'],
+            ]);
+
+            return response()->json([
+                'active' => true,
+                // Refreshing the signed token also applies subscription edition/expiry changes
+                // without requiring the user to reactivate manually.
+                'licenseToken' => $signer->sign($license, $data['installationID']),
+            ]);
         });
     }
 
     public function deactivate(Request $request, LicenseTokenVerifier $verifier): JsonResponse
     {
-        $data = $request->validate(['licenseToken'=>['required','string','max:8192'],'installationID'=>['required','uuid']]);
-        try { $payload = $verifier->verify($data['licenseToken']); }
-        catch (\Throwable) { return response()->json(['message'=>'The licence token is invalid.'], 400); }
-        if (strcasecmp((string)($payload['installationID'] ?? ''), $data['installationID']) !== 0) return response()->json(['message'=>'The installation does not match this licence token.'], 400);
-        LicenseActivation::where('license_id',(string)($payload['licenseID'] ?? ''))->where('installation_id',strtolower($data['installationID']))->whereNull('deactivated_at')->update(['deactivated_at'=>now(),'last_seen_at'=>now()]);
-        return response()->json((object)[]);
+        $data = $request->validate([
+            'licenseToken' => ['required', 'string', 'max:8192'],
+            'installationID' => ['required', 'uuid'],
+        ]);
+
+        try {
+            $payload = $verifier->verify($data['licenseToken']);
+        } catch (\Throwable) {
+            return response()->json(['message' => 'The licence token is invalid.'], 400);
+        }
+
+        if (strcasecmp((string) ($payload['installationID'] ?? ''), $data['installationID']) !== 0) {
+            return response()->json(['message' => 'The installation does not match this licence token.'], 400);
+        }
+
+        LicenseActivation::where('license_id', (string) ($payload['licenseID'] ?? ''))
+            ->where('installation_id', strtolower($data['installationID']))
+            ->whereNull('deactivated_at')
+            ->update(['deactivated_at' => now(), 'last_seen_at' => now()]);
+
+        return response()->json((object) []);
     }
 }

rsync-studio-licensing/app/Http/Controllers/Api/PaymentWebhookController.php

@@ -1,8 +1,10 @@
 <?php
+
 namespace App\Http\Controllers\Api;
 
 use App\Http\Controllers\Controller;
 use App\Models\LicenseWebhookEvent;
+use App\Services\Licensing\LicenseDeliveryService;
 use App\Services\Payments\LemonSqueezyWebhookVerifier;
 use App\Services\Payments\PaddleWebhookVerifier;
 use App\Services\Payments\PurchaseProvisioner;
@@ -12,26 +14,65 @@ use Illuminate\Support\Facades\DB;
 
 final class PaymentWebhookController extends Controller
 {
-    public function __invoke(string $provider, Request $request, PurchaseProvisioner $provisioner): JsonResponse
+    public function __invoke(string $provider, Request $request, PurchaseProvisioner $provisioner, LicenseDeliveryService $delivery): JsonResponse
     {
-        $raw=(string)$request->getContent();
-        $verifier=match($provider){'paddle'=>app(PaddleWebhookVerifier::class),'lemon-squeezy'=>app(LemonSqueezyWebhookVerifier::class),default=>null};
-        if (!$verifier) return response()->json(['message'=>'Unknown webhook provider.'],404);
-        try { $verifier->verify($request,$raw); } catch (\Throwable $e) { report($e); return response()->json(['message'=>'Invalid webhook signature.'],400); }
-        try { $payload=json_decode($raw,true,flags:JSON_THROW_ON_ERROR); } catch (\Throwable) { return response()->json(['message'=>'Invalid JSON.'],400); }
-        $externalID=(string)($provider==='paddle'?($payload['event_id']??''):($payload['meta']['event_name']??'').':'.($payload['data']['id']??''));
-        $eventType=(string)($provider==='paddle'?($payload['event_type']??'unknown'):($payload['meta']['event_name']??'unknown'));
-        if ($externalID==='') return response()->json(['message'=>'Webhook event has no stable identifier.'],400);
+        $raw = (string) $request->getContent();
+        $verifier = match ($provider) {
+            'paddle' => app(PaddleWebhookVerifier::class),'lemon-squeezy' => app(LemonSqueezyWebhookVerifier::class),default => null
+        };
+        if (! $verifier) {
+            return response()->json(['message' => 'Unknown webhook provider.'], 404);
+        }
+        try {
+            $verifier->verify($request, $raw);
+        } catch (\Throwable $e) {
+            report($e);
+
+            return response()->json(['message' => 'Invalid webhook signature.'], 400);
+        }
+        try {
+            $payload = json_decode($raw, true, flags: JSON_THROW_ON_ERROR);
+        } catch (\Throwable) {
+            return response()->json(['message' => 'Invalid JSON.'], 400);
+        }
+        $externalID = (string) ($provider === 'paddle' ? ($payload['event_id'] ?? '') : ($payload['meta']['event_name'] ?? '').':'.($payload['data']['id'] ?? ''));
+        $eventType = (string) ($provider === 'paddle' ? ($payload['event_type'] ?? 'unknown') : ($payload['meta']['event_name'] ?? 'unknown'));
+        if ($externalID === '') {
+            return response()->json(['message' => 'Webhook event has no stable identifier.'], 400);
+        }
 
         try {
-            DB::transaction(function() use($provider,$externalID,$eventType,$payload,$raw,$provisioner){
-                $event=LicenseWebhookEvent::firstOrCreate(['provider'=>$provider,'external_event_id'=>$externalID],['event_type'=>$eventType,'payload_sha256'=>hash('sha256',$raw),'payload'=>$payload]);
-                if ($event->processed_at) return;
-                if (!hash_equals($event->payload_sha256,hash('sha256',$raw))) throw new \RuntimeException('Webhook ID was reused with a different payload.');
-                try { $provisioner->provision($provider,$payload); $event->update(['processed_at'=>now(),'processing_error'=>null]); }
-                catch (\Throwable $e) { $event->update(['processing_error'=>mb_substr($e->getMessage(),0,4000)]); throw $e; }
+            DB::transaction(function () use ($provider, $externalID, $eventType, $payload, $raw, $provisioner) {
+                $event = LicenseWebhookEvent::firstOrCreate(['provider' => $provider, 'external_event_id' => $externalID], ['event_type' => $eventType, 'payload_sha256' => hash('sha256', $raw), 'payload' => $payload]);
+                if ($event->processed_at) {
+                    return;
+                }
+                if (! hash_equals($event->payload_sha256, hash('sha256', $raw))) {
+                    throw new \RuntimeException('Webhook ID was reused with a different payload.');
+                }
+                try {
+                    $provisioner->provision($provider, $payload);
+                    $event->update(['processed_at' => now(), 'processing_error' => null]);
+                } catch (\Throwable $e) {
+                    $event->update(['processing_error' => mb_substr($e->getMessage(), 0, 4000)]);
+                    throw $e;
+                }
             });
-        } catch (\Throwable $e) { report($e); return response()->json(['message'=>'Webhook could not be processed.'],500); }
-        return response()->json(['ok'=>true]);
+        } catch (\Throwable $e) {
+            report($e);
+
+            return response()->json(['message' => 'Webhook could not be processed.'], 500);
+        }
+
+        // Delivery is intentionally outside the webhook transaction. A temporary mail
+        // outage must not roll back an otherwise valid Paddle event. Pending outbox
+        // rows remain available for portal resend or a later webhook delivery attempt.
+        try {
+            $delivery->deliverPending(10);
+        } catch (\Throwable $e) {
+            report($e);
+        }
+
+        return response()->json(['ok' => true]);
     }
 }

rsync-studio-licensing/app/Http/Controllers/Auth/AuthenticatedSessionController.php

@@ -1,14 +1,35 @@
 <?php
+
 namespace App\Http\Controllers\Auth;
+
 use App\Http\Controllers\Controller;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Auth;
-final class AuthenticatedSessionController extends Controller {
- public function create(){ return view('auth.login'); }
- public function store(Request $request){
-   $credentials=$request->validate(['email'=>['required','email'],'password'=>['required','string']]);
-   if(!Auth::attempt(['email'=>strtolower($credentials['email']),'password'=>$credentials['password']], $request->boolean('remember'))){ return back()->withErrors(['email'=>'The supplied credentials are invalid.'])->onlyInput('email'); }
-   $request->session()->regenerate(); return redirect()->intended(route('portal.index'));
- }
- public function destroy(Request $request){ Auth::logout(); $request->session()->invalidate(); $request->session()->regenerateToken(); return redirect()->route('login'); }
+
+final class AuthenticatedSessionController extends Controller
+{
+    public function create()
+    {
+        return view('auth.login');
+    }
+
+    public function store(Request $request)
+    {
+        $credentials = $request->validate(['email' => ['required', 'email'], 'password' => ['required', 'string']]);
+        if (! Auth::attempt(['email' => strtolower($credentials['email']), 'password' => $credentials['password']], $request->boolean('remember'))) {
+            return back()->withErrors(['email' => 'The supplied credentials are invalid.'])->onlyInput('email');
+        }
+        $request->session()->regenerate();
+
+        return redirect()->intended(route('portal.index'));
+    }
+
+    public function destroy(Request $request)
+    {
+        Auth::logout();
+        $request->session()->invalidate();
+        $request->session()->regenerateToken();
+
+        return redirect()->route('login');
+    }
 }

rsync-studio-licensing/app/Http/Controllers/Auth/EmailVerificationController.php

@@ -1,10 +1,31 @@
 <?php
+
 namespace App\Http\Controllers\Auth;
+
 use App\Http\Controllers\Controller;
 use Illuminate\Foundation\Auth\EmailVerificationRequest;
 use Illuminate\Http\Request;
-final class EmailVerificationController extends Controller {
- public function notice(){ return view('auth.verify-email'); }
- public function verify(EmailVerificationRequest $request){ $request->fulfill(); return redirect()->route('portal.index')->with('status','Email verified.'); }
- public function resend(Request $request){ if(!$request->user()->hasVerifiedEmail()) $request->user()->sendEmailVerificationNotification(); return back()->with('status','Verification link sent.'); }
+
+final class EmailVerificationController extends Controller
+{
+    public function notice()
+    {
+        return view('auth.verify-email');
+    }
+
+    public function verify(EmailVerificationRequest $request)
+    {
+        $request->fulfill();
+
+        return redirect()->route('portal.index')->with('status', 'Email verified.');
+    }
+
+    public function resend(Request $request)
+    {
+        if (! $request->user()->hasVerifiedEmail()) {
+            $request->user()->sendEmailVerificationNotification();
+        }
+
+return back()->with('status', 'Verification link sent.');
+    }
 }

rsync-studio-licensing/app/Http/Controllers/Auth/PasswordController.php

@@ -1,5 +1,7 @@
 <?php
+
 namespace App\Http\Controllers\Auth;
+
 use App\Http\Controllers\Controller;
 use App\Models\User;
 use Illuminate\Auth\Events\PasswordReset;
@@ -7,9 +9,35 @@ use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Password;
 use Illuminate\Support\Str;
 use Illuminate\Validation\Rules\Password as PasswordRule;
-final class PasswordController extends Controller {
- public function requestForm(){ return view('auth.forgot-password'); }
- public function email(Request $request){ $request->validate(['email'=>['required','email']]); $status=Password::sendResetLink(['email'=>strtolower($request->email)]); return $status===Password::RESET_LINK_SENT?back()->with('status',__($status)):back()->withErrors(['email'=>__($status)]); }
- public function resetForm(Request $request,string $token){ return view('auth.reset-password',['token'=>$token,'email'=>$request->query('email')]); }
- public function reset(Request $request){ $data=$request->validate(['token'=>['required'],'email'=>['required','email'],'password'=>['required','confirmed',PasswordRule::min(12)->letters()->mixedCase()->numbers()]]); $status=Password::reset($data,function(User $user,string $password){$user->forceFill(['password'=>$password,'remember_token'=>Str::random(60)])->save();event(new PasswordReset($user));}); return $status===Password::PASSWORD_RESET?redirect()->route('login')->with('status',__($status)):back()->withErrors(['email'=>__($status)]); }
+
+final class PasswordController extends Controller
+{
+    public function requestForm()
+    {
+        return view('auth.forgot-password');
+    }
+
+    public function email(Request $request)
+    {
+        $request->validate(['email' => ['required', 'email']]);
+        $status = Password::sendResetLink(['email' => strtolower($request->email)]);
+
+        return $status === Password::RESET_LINK_SENT ? back()->with('status', __($status)) : back()->withErrors(['email' => __($status)]);
+    }
+
+    public function resetForm(Request $request, string $token)
+    {
+        return view('auth.reset-password', ['token' => $token, 'email' => $request->query('email')]);
+    }
+
+    public function reset(Request $request)
+    {
+        $data = $request->validate(['token' => ['required'], 'email' => ['required', 'email'], 'password' => ['required', 'confirmed', PasswordRule::min(12)->letters()->mixedCase()->numbers()]]);
+        $status = Password::reset($data, function (User $user, string $password) {
+            $user->forceFill(['password' => $password, 'remember_token' => Str::random(60)])->save();
+            event(new PasswordReset($user));
+        });
+
+        return $status === Password::PASSWORD_RESET ? redirect()->route('login')->with('status', __($status)) : back()->withErrors(['email' => __($status)]);
+    }
 }

rsync-studio-licensing/app/Http/Controllers/Auth/RegisteredUserController.php

@@ -1,15 +1,29 @@
 <?php
+
 namespace App\Http\Controllers\Auth;
+
 use App\Http\Controllers\Controller;
 use App\Models\User;
 use Illuminate\Auth\Events\Registered;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Auth;
 use Illuminate\Validation\Rules\Password;
-final class RegisteredUserController extends Controller {
- public function create(){ return view('auth.register'); }
- public function store(Request $request){
-   $data=$request->validate(['name'=>['required','string','max:120'],'email'=>['required','email','max:255','unique:users,email'],'password'=>['required','confirmed',Password::min(12)->letters()->mixedCase()->numbers()]]);
-   $user=User::create(['name'=>$data['name'],'email'=>strtolower($data['email']),'password'=>$data['password']]); event(new Registered($user)); Auth::login($user); $request->session()->regenerate(); return redirect()->route('verification.notice');
- }
+
+final class RegisteredUserController extends Controller
+{
+    public function create()
+    {
+        return view('auth.register');
+    }
+
+    public function store(Request $request)
+    {
+        $data = $request->validate(['name' => ['required', 'string', 'max:120'], 'email' => ['required', 'email', 'max:255', 'unique:users,email'], 'password' => ['required', 'confirmed', Password::min(12)->letters()->mixedCase()->numbers()]]);
+        $user = User::create(['name' => $data['name'], 'email' => strtolower($data['email']), 'password' => $data['password']]);
+        event(new Registered($user));
+        Auth::login($user);
+        $request->session()->regenerate();
+
+        return redirect()->route('verification.notice');
+    }
 }

rsync-studio-licensing/app/Http/Controllers/CheckoutController.php

@@ -0,0 +1,38 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use Illuminate\Contracts\View\View;
+use RuntimeException;
+
+final class CheckoutController extends Controller
+{
+    public function __invoke(): View
+    {
+        $paddle = config('rsync-studio.paddle');
+        $token = trim((string) ($paddle['client_side_token'] ?? ''));
+
+        if ($token === '') {
+            throw new RuntimeException('PADDLE_CLIENT_SIDE_TOKEN is not configured.');
+        }
+
+        $plans = [
+            'personal-monthly' => ['name' => 'Personal', 'billing' => 'Monthly', 'display_price' => '£1.99 / month', 'price_id' => $paddle['personal_monthly_price_id'], 'activation_limit' => 1],
+            'personal-annual' => ['name' => 'Personal', 'billing' => 'Annual', 'display_price' => '£14.99 / year', 'price_id' => $paddle['personal_annual_price_id'], 'activation_limit' => 1],
+            'professional-monthly' => ['name' => 'Professional', 'billing' => 'Monthly', 'display_price' => '£3.99 / month', 'price_id' => $paddle['professional_monthly_price_id'], 'activation_limit' => 3],
+            'professional-annual' => ['name' => 'Professional', 'billing' => 'Annual', 'display_price' => '£29.99 / year', 'price_id' => $paddle['professional_annual_price_id'], 'activation_limit' => 3],
+        ];
+
+        foreach ($plans as $plan) {
+            if (trim((string) $plan['price_id']) === '') {
+                throw new RuntimeException('One or more Paddle price IDs are not configured.');
+            }
+        }
+
+        return view('checkout.buy', [
+            'plans' => $plans,
+            'paddleToken' => $token,
+            'paddleEnvironment' => (string) ($paddle['environment'] ?? 'sandbox'),
+        ]);
+    }
+}

rsync-studio-licensing/app/Http/Controllers/Portal/PortalController.php

@@ -1,15 +1,142 @@
 <?php
+
 namespace App\Http\Controllers\Portal;
+
 use App\Http\Controllers\Controller;
 use App\Models\License;
 use App\Models\LicenseDeliveryOutbox;
+use App\Models\LicenseProduct;
+use App\Services\Payments\PaddleClient;
+use Illuminate\Http\RedirectResponse;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Crypt;
 use Illuminate\Support\Facades\Mail;
-final class PortalController extends Controller {
- private function owned(Request $request){ return License::with(['product','activations'])->whereRaw('lower(customer_email) = ?', [strtolower($request->user()->email)]); }
- public function index(Request $request){ return view('portal.index',['licenses'=>$this->owned($request)->latest()->get()]); }
- public function show(Request $request,License $license){ abort_unless(strtolower((string)$license->customer_email)===strtolower($request->user()->email),404); $license->load(['product','activations']); return view('portal.show',compact('license')); }
- public function deactivate(Request $request,License $license,int $activation){ abort_unless(strtolower((string)$license->customer_email)===strtolower($request->user()->email),404); $item=$license->activations()->whereKey($activation)->firstOrFail(); if(!$item->deactivated_at){$item->update(['deactivated_at'=>now()]);} return back()->with('status','Activation released.'); }
- public function resend(Request $request,License $license){ abort_unless(strtolower((string)$license->customer_email)===strtolower($request->user()->email),404); $out=LicenseDeliveryOutbox::where('license_id',$license->id)->first(); if(!$out) return back()->withErrors(['licence'=>'This licence was issued manually and its full key is not recoverable. Contact support.']); $plain=Crypt::decryptString($out->encrypted_license_key); Mail::raw("Your Rsync Studio licence key is:\n\n{$plain}\n\nKeep this key private.",fn($m)=>$m->to($request->user()->email)->subject('Your Rsync Studio licence key')); $out->update(['delivered_at'=>now()]); return back()->with('status','Licence key sent to your verified email address.'); }
+use RuntimeException;
+
+final class PortalController extends Controller
+{
+    public function __construct(private PaddleClient $paddle) {}
+
+    private function owned(Request $request)
+    {
+        return License::with(['product', 'activations'])
+            ->whereRaw('lower(customer_email) = ?', [strtolower($request->user()->email)]);
+    }
+
+    public function index(Request $request)
+    {
+        $licenses = $this->owned($request)->latest()->get();
+        $hasProfessional = $licenses->contains(fn (License $license) => $license->is_usable && $license->edition === 'Professional');
+
+        return view('portal.index', compact('licenses', 'hasProfessional'));
+    }
+
+    public function show(Request $request, License $license)
+    {
+        $this->authorise($request, $license);
+        $license->load(['product', 'activations']);
+
+        return view('portal.show', compact('license'));
+    }
+
+    public function upgrade(Request $request, License $license): RedirectResponse
+    {
+        $this->authorise($request, $license);
+        abort_unless($license->payment_provider === 'paddle' && $license->external_subscription_id, 422);
+        abort_unless($license->edition === 'Personal' && $license->is_usable, 422);
+
+        $targetPriceID = $this->professionalPriceFor($license);
+        $targetProduct = LicenseProduct::query()
+            ->where('payment_provider', 'paddle')
+            ->where('external_price_id', $targetPriceID)
+            ->where('active', true)
+            ->firstOrFail();
+
+        try {
+            $subscription = $this->paddle->updateSubscriptionPrice($license->external_subscription_id, $targetPriceID);
+        } catch (RuntimeException $exception) {
+            return back()->withErrors(['licence' => $exception->getMessage()]);
+        }
+
+        // Apply the entitlement immediately. Paddle webhooks remain authoritative and
+        // will reconcile subscription status/current-period details afterwards.
+        $license->update([
+            'license_product_id' => $targetProduct->id,
+            'edition' => $targetProduct->edition,
+            'activation_limit' => $targetProduct->activation_limit,
+            'max_major_version' => $targetProduct->max_major_version,
+            'external_price_id' => $targetPriceID,
+            'subscription_status' => (string) ($subscription['status'] ?? $license->subscription_status),
+            'revoked_at' => null,
+            'revoke_reason' => null,
+        ]);
+
+        return redirect()->route('portal.show', $license)->with('status', 'Upgraded to Professional. Your existing Paddle subscription was changed; no second subscription was created.');
+    }
+
+    public function cancel(Request $request, License $license): RedirectResponse
+    {
+        $this->authorise($request, $license);
+        abort_unless($license->payment_provider === 'paddle' && $license->external_subscription_id, 422);
+        abort_unless(! in_array($license->subscription_status, ['canceled'], true), 422);
+
+        try {
+            $this->paddle->cancelSubscriptionImmediately($license->external_subscription_id);
+        } catch (RuntimeException $exception) {
+            return back()->withErrors(['licence' => $exception->getMessage()]);
+        }
+
+        $license->update([
+            'subscription_status' => 'canceled',
+            'expires_at' => now(),
+            'revoked_at' => now(),
+            'revoke_reason' => 'Subscription canceled from licence portal',
+            'cancel_scheduled_at' => null,
+        ]);
+
+        return redirect()->route('portal.index')->with('status', 'Subscription canceled in Paddle and the licence is no longer active.');
+    }
+
+    public function deactivate(Request $request, License $license, int $activation)
+    {
+        $this->authorise($request, $license);
+        $item = $license->activations()->whereKey($activation)->firstOrFail();
+        if (! $item->deactivated_at) {
+            $item->update(['deactivated_at' => now()]);
+        }
+
+        return back()->with('status', 'Mac deactivated. Rsync Studio will detect this through the licensing API.');
+    }
+
+    public function resend(Request $request, License $license)
+    {
+        $this->authorise($request, $license);
+        $out = LicenseDeliveryOutbox::where('license_id', $license->id)->first();
+        if (! $out) {
+            return back()->withErrors(['licence' => 'This licence was issued manually and its full key is not recoverable. Contact support.']);
+        }
+
+        $plain = Crypt::decryptString($out->encrypted_license_key);
+        Mail::raw("Your Rsync Studio licence key is:\n\n{$plain}\n\nKeep this key private.", fn ($m) => $m->to($request->user()->email)->subject('Your Rsync Studio licence key'));
+        $out->update(['delivered_at' => now()]);
+
+        return back()->with('status', 'Licence key sent to your verified email address.');
+    }
+
+    private function authorise(Request $request, License $license): void
+    {
+        abort_unless(strtolower((string) $license->customer_email) === strtolower($request->user()->email), 404);
+    }
+
+    private function professionalPriceFor(License $license): string
+    {
+        $paddle = config('rsync-studio.paddle');
+        $current = (string) $license->external_price_id;
+
+        if ($current === (string) ($paddle['personal_annual_price_id'] ?? '')) {
+            return (string) ($paddle['professional_annual_price_id'] ?? '');
+        }
+
+        return (string) ($paddle['professional_monthly_price_id'] ?? '');
+    }
 }

rsync-studio-licensing/app/Http/Controllers/Support/SupportController.php

@@ -0,0 +1,92 @@
+<?php
+
+namespace App\Http\Controllers\Support;
+
+use App\Http\Controllers\Controller;
+use App\Models\SupportTicket;
+use App\Models\User;
+use App\Notifications\NewSupportTicket;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Mail;
+use Illuminate\Support\Facades\Notification;
+use Illuminate\Support\Str;
+
+final class SupportController extends Controller
+{
+    public function create(Request $request)
+    {
+        return view('support', [
+            'categories' => [
+                'technical' => 'Technical support',
+                'licensing' => 'Licence & activation',
+                'billing' => 'Billing & subscription',
+                'feature' => 'Feature request',
+                'privacy' => 'Privacy / data request',
+                'general' => 'General enquiry',
+            ],
+        ]);
+    }
+
+    public function store(Request $request): RedirectResponse
+    {
+        // Honeypot: bots tend to fill hidden fields. Return success without retaining spam.
+        if (filled($request->input('company_website'))) {
+            return back()->with('status', 'Your support request has been received.');
+        }
+
+        $data = $request->validate([
+            'name' => ['required', 'string', 'max:120'],
+            'email' => ['required', 'email:rfc', 'max:254'],
+            'category' => ['required', 'in:technical,licensing,billing,feature,privacy,general'],
+            'subject' => ['required', 'string', 'max:180'],
+            'message' => ['required', 'string', 'min:10', 'max:10000'],
+            'privacy_notice' => ['accepted'],
+        ]);
+
+        $ticket = SupportTicket::create([
+            'user_id' => $request->user()?->id,
+            'reference' => $this->reference(),
+            'name' => $data['name'],
+            'email' => strtolower($data['email']),
+            'category' => $data['category'],
+            'subject' => $data['subject'],
+            'message' => $data['message'],
+            'privacy_notice_accepted_at' => now(),
+        ]);
+
+        $this->notifyTeam($ticket);
+
+        Mail::raw(
+            "We received your Rsync Studio support request.\n\nReference: {$ticket->reference}\nSubject: {$ticket->subject}\n\nWe will reply to this email address. Please keep the reference in any follow-up.",
+            fn ($mail) => $mail->to($ticket->email)->subject("Rsync Studio support request {$ticket->reference}")
+        );
+
+        return redirect()->route('support')->with('status', "Support request {$ticket->reference} received. A confirmation has been emailed to you.");
+    }
+
+    private function notifyTeam(SupportTicket $ticket): void
+    {
+        if (config('rsync-studio.support.notify_admin_users', true)) {
+            User::query()->where('is_admin', true)->get()->each->notify(new NewSupportTicket($ticket));
+        }
+
+        $emails = collect(config('rsync-studio.support.alert_emails', []))
+            ->filter(fn ($email) => filter_var($email, FILTER_VALIDATE_EMAIL))
+            ->unique()
+            ->values();
+
+        if ($emails->isNotEmpty()) {
+            Notification::route('mail', $emails->all())->notify(new NewSupportTicket($ticket));
+        }
+    }
+
+    private function reference(): string
+    {
+        do {
+            $reference = 'RS-'.now()->format('ymd').'-'.Str::upper(Str::random(6));
+        } while (SupportTicket::where('reference', $reference)->exists());
+
+        return $reference;
+    }
+}

rsync-studio-licensing/app/Http/Middleware/AdminOnly.php

@@ -1,11 +1,17 @@
 <?php
+
 namespace App\Http\Middleware;
+
 use Closure;
 use Illuminate\Http\Request;
 use Symfony\Component\HttpFoundation\Response;
-final class AdminOnly {
-    public function handle(Request $request, Closure $next): Response {
+
+final class AdminOnly
+{
+    public function handle(Request $request, Closure $next): Response
+    {
         abort_unless($request->user()?->is_admin === true, 403);
+
         return $next($request);
     }
 }

rsync-studio-licensing/app/Models/License.php

@@ -1,4 +1,5 @@
 <?php
+
 namespace App\Models;
 
 use Illuminate\Database\Eloquent\Concerns\HasUuids;
@@ -9,11 +10,27 @@ use Illuminate\Database\Eloquent\Relations\HasMany;
 class License extends Model
 {
     use HasUuids;
+
     public $incrementing = false;
+
     protected $keyType = 'string';
-    protected $fillable = ['license_product_id','license_key_hash','license_key_last4','customer_name','customer_email','edition','activation_limit','max_major_version','expires_at','revoked_at','revoke_reason','payment_provider','external_order_id','external_customer_id'];
-    protected $casts = ['expires_at'=>'datetime','revoked_at'=>'datetime','activation_limit'=>'integer','max_major_version'=>'integer'];
-    public function product(): BelongsTo { return $this->belongsTo(LicenseProduct::class, 'license_product_id'); }
-    public function activations(): HasMany { return $this->hasMany(LicenseActivation::class); }
-    public function getIsUsableAttribute(): bool { return $this->revoked_at === null && ($this->expires_at === null || $this->expires_at->isFuture()); }
+
+    protected $fillable = ['license_product_id', 'license_key_hash', 'license_key_last4', 'customer_name', 'customer_email', 'edition', 'activation_limit', 'max_major_version', 'expires_at', 'revoked_at', 'revoke_reason', 'payment_provider', 'external_order_id', 'external_customer_id', 'external_subscription_id', 'external_price_id', 'subscription_status', 'current_period_ends_at', 'cancel_scheduled_at'];
+
+    protected $casts = ['expires_at' => 'datetime', 'revoked_at' => 'datetime', 'activation_limit' => 'integer', 'max_major_version' => 'integer', 'current_period_ends_at' => 'datetime', 'cancel_scheduled_at' => 'datetime'];
+
+    public function product(): BelongsTo
+    {
+        return $this->belongsTo(LicenseProduct::class, 'license_product_id');
+    }
+
+    public function activations(): HasMany
+    {
+        return $this->hasMany(LicenseActivation::class);
+    }
+
+    public function getIsUsableAttribute(): bool
+    {
+        return $this->revoked_at === null && ($this->expires_at === null || $this->expires_at->isFuture());
+    }
 }

rsync-studio-licensing/app/Models/LicenseActivation.php

@@ -1,9 +1,14 @@
 <?php
+
 namespace App\Models;
+
 use Illuminate\Database\Eloquent\Model;
+
 class LicenseActivation extends Model
 {
     public $timestamps = false;
-    protected $fillable = ['license_id','installation_id','installation_name','platform','app_version','activated_at','last_seen_at','deactivated_at'];
-    protected $casts = ['activated_at'=>'datetime','last_seen_at'=>'datetime','deactivated_at'=>'datetime'];
+
+    protected $fillable = ['license_id', 'installation_id', 'installation_name', 'platform', 'app_version', 'activated_at', 'last_seen_at', 'deactivated_at'];
+
+    protected $casts = ['activated_at' => 'datetime', 'last_seen_at' => 'datetime', 'deactivated_at' => 'datetime'];
 }

rsync-studio-licensing/app/Models/LicenseDeliveryOutbox.php

@@ -1,9 +1,14 @@
 <?php
+
 namespace App\Models;
+
 use Illuminate\Database\Eloquent\Model;
+
 class LicenseDeliveryOutbox extends Model
 {
     protected $table = 'license_delivery_outbox';
-    protected $fillable = ['license_id','encrypted_license_key','recipient_email','delivered_at'];
-    protected $casts = ['delivered_at'=>'datetime'];
+
+    protected $fillable = ['license_id', 'encrypted_license_key', 'recipient_email', 'delivered_at'];
+
+    protected $casts = ['delivered_at' => 'datetime'];
 }

rsync-studio-licensing/app/Models/LicenseProduct.php

@@ -1,10 +1,12 @@
 <?php
+
 namespace App\Models;
 
 use Illuminate\Database\Eloquent\Model;
 
 class LicenseProduct extends Model
 {
-    protected $fillable = ['code','name','edition','activation_limit','max_major_version','payment_provider','external_product_id','external_price_id','active'];
-    protected $casts = ['active'=>'boolean','activation_limit'=>'integer','max_major_version'=>'integer'];
+    protected $fillable = ['code', 'name', 'edition', 'activation_limit', 'max_major_version', 'payment_provider', 'external_product_id', 'external_price_id', 'active'];
+
+    protected $casts = ['active' => 'boolean', 'activation_limit' => 'integer', 'max_major_version' => 'integer'];
 }

rsync-studio-licensing/app/Models/LicenseWebhookEvent.php

@@ -1,8 +1,12 @@
 <?php
+
 namespace App\Models;
+
 use Illuminate\Database\Eloquent\Model;
+
 class LicenseWebhookEvent extends Model
 {
-    protected $fillable = ['provider','external_event_id','event_type','payload_sha256','payload','processed_at','processing_error'];
-    protected $casts = ['payload'=>'array','processed_at'=>'datetime'];
+    protected $fillable = ['provider', 'external_event_id', 'event_type', 'payload_sha256', 'payload', 'processed_at', 'processing_error'];
+
+    protected $casts = ['payload' => 'array', 'processed_at' => 'datetime'];
 }

rsync-studio-licensing/app/Models/SupportTicket.php

@@ -0,0 +1,46 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Prunable;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+
+class SupportTicket extends Model
+{
+    use Prunable;
+
+    protected $fillable = [
+        'user_id', 'assigned_to', 'reference', 'name', 'email', 'category',
+        'subject', 'message', 'status', 'priority', 'privacy_notice_accepted_at',
+        'resolved_at',
+    ];
+
+    protected function casts(): array
+    {
+        return [
+            'privacy_notice_accepted_at' => 'datetime',
+            'resolved_at' => 'datetime',
+        ];
+    }
+
+    public function user(): BelongsTo
+    {
+        return $this->belongsTo(User::class);
+    }
+
+    public function assignee(): BelongsTo
+    {
+        return $this->belongsTo(User::class, 'assigned_to');
+    }
+
+    public function prunable(): Builder
+    {
+        $days = max(30, (int) config('rsync-studio.privacy.support_retention_days', 730));
+
+        return static::query()
+            ->whereNotNull('resolved_at')
+            ->where('resolved_at', '<=', now()->subDays($days));
+    }
+}

rsync-studio-licensing/app/Models/User.php

@@ -1,4 +1,5 @@
 <?php
+
 namespace App\Models;
 
 use Illuminate\Contracts\Auth\MustVerifyEmail;
@@ -9,7 +10,13 @@ use Illuminate\Notifications\Notifiable;
 class User extends Authenticatable implements MustVerifyEmail
 {
     use HasFactory, Notifiable;
-    protected $fillable = ['name','email','password','is_admin'];
-    protected $hidden = ['password','remember_token'];
-    protected function casts(): array { return ['email_verified_at'=>'datetime','password'=>'hashed','is_admin'=>'boolean']; }
+
+    protected $fillable = ['name', 'email', 'password', 'is_admin'];
+
+    protected $hidden = ['password', 'remember_token'];
+
+    protected function casts(): array
+    {
+        return ['email_verified_at' => 'datetime', 'password' => 'hashed', 'is_admin' => 'boolean'];
+    }
 }

rsync-studio-licensing/app/Notifications/NewSupportTicket.php

@@ -0,0 +1,43 @@
+<?php
+
+namespace App\Notifications;
+
+use App\Models\SupportTicket;
+use Illuminate\Bus\Queueable;
+use Illuminate\Notifications\AnonymousNotifiable;
+use Illuminate\Notifications\Messages\MailMessage;
+use Illuminate\Notifications\Notification;
+
+class NewSupportTicket extends Notification
+{
+    use Queueable;
+
+    public function __construct(public readonly SupportTicket $ticket) {}
+
+    public function via(object $notifiable): array
+    {
+        return $notifiable instanceof AnonymousNotifiable ? ['mail'] : ['database', 'mail'];
+    }
+
+    public function toMail(object $notifiable): MailMessage
+    {
+        return (new MailMessage)
+            ->subject("New Rsync Studio support request {$this->ticket->reference}")
+            ->greeting('New support request')
+            ->line("{$this->ticket->name} <{$this->ticket->email}>")
+            ->line("Category: {$this->ticket->category}")
+            ->line("Subject: {$this->ticket->subject}")
+            ->line($this->ticket->message)
+            ->action('Open support ticket', route('admin.support.show', $this->ticket));
+    }
+
+    public function toArray(object $notifiable): array
+    {
+        return [
+            'support_ticket_id' => $this->ticket->id,
+            'reference' => $this->ticket->reference,
+            'subject' => $this->ticket->subject,
+            'email' => $this->ticket->email,
+        ];
+    }
+}

rsync-studio-licensing/app/Services/Licensing/LicenseDeliveryService.php

@@ -0,0 +1,40 @@
+<?php
+
+namespace App\Services\Licensing;
+
+use App\Models\LicenseDeliveryOutbox;
+use Illuminate\Support\Facades\Crypt;
+use Illuminate\Support\Facades\Mail;
+
+final class LicenseDeliveryService
+{
+    public function deliverPending(int $limit = 20): int
+    {
+        $delivered = 0;
+        $pending = LicenseDeliveryOutbox::query()
+            ->whereNull('delivered_at')
+            ->whereNotNull('recipient_email')
+            ->where('recipient_email', '!=', '')
+            ->oldest()
+            ->limit(max(1, min($limit, 100)))
+            ->get();
+
+        foreach ($pending as $outbox) {
+            $plain = Crypt::decryptString($outbox->encrypted_license_key);
+            $recipient = strtolower(trim((string) $outbox->recipient_email));
+            if ($recipient === '') {
+                continue;
+            }
+
+            Mail::raw(
+                "Thank you for choosing Rsync Studio.\n\nYour licence key is:\n\n{$plain}\n\nOpen Rsync Studio → Settings → Licence and enter this key to activate your Mac.\n\nKeep this key private. You can manage activations from the Rsync Studio licence portal.",
+                fn ($message) => $message->to($recipient)->subject('Your Rsync Studio licence key')
+            );
+
+            $outbox->update(['delivered_at' => now()]);
+            $delivered++;
+        }
+
+        return $delivered;
+    }
+}

rsync-studio-licensing/app/Services/Licensing/LicenseIssuer.php

@@ -1,41 +1,45 @@
 <?php
+
 namespace App\Services\Licensing;
 
 use App\Models\License;
-use App\Models\LicenseProduct;
 use App\Models\LicenseDeliveryOutbox;
-use Illuminate\Support\Facades\DB;
+use App\Models\LicenseProduct;
 use Illuminate\Support\Facades\Crypt;
+use Illuminate\Support\Facades\DB;
 
 final class LicenseIssuer
 {
     public function issue(LicenseProduct $product, ?string $name, ?string $email, ?string $provider = null, ?string $orderID = null, ?string $customerID = null, bool $queueDelivery = false): array
     {
-        return DB::transaction(function () use ($product,$name,$email,$provider,$orderID,$customerID,$queueDelivery) {
+        return DB::transaction(function () use ($product, $name, $email, $provider, $orderID, $customerID, $queueDelivery) {
             if ($provider && $orderID) {
-                $existing = License::where('payment_provider',$provider)->where('external_order_id',$orderID)->first();
-                if ($existing) return [$existing, null];
+                $existing = License::where('payment_provider', $provider)->where('external_order_id', $orderID)->first();
+                if ($existing) {
+                    return [$existing, null];
+                }
             }
             $plain = LicenseKey::generate();
             $license = License::create([
-                'license_product_id'=>$product->id,
-                'license_key_hash'=>LicenseKey::hash($plain),
-                'license_key_last4'=>substr(LicenseKey::normalize($plain), -4),
-                'customer_name'=>$name,
-                'customer_email'=>$email ? strtolower(trim($email)) : null,
-                'edition'=>$product->edition,
-                'activation_limit'=>$product->activation_limit,
-                'max_major_version'=>$product->max_major_version,
-                'payment_provider'=>$provider,
-                'external_order_id'=>$orderID,
-                'external_customer_id'=>$customerID,
+                'license_product_id' => $product->id,
+                'license_key_hash' => LicenseKey::hash($plain),
+                'license_key_last4' => substr(LicenseKey::normalize($plain), -4),
+                'customer_name' => $name,
+                'customer_email' => $email ? strtolower(trim($email)) : null,
+                'edition' => $product->edition,
+                'activation_limit' => $product->activation_limit,
+                'max_major_version' => $product->max_major_version,
+                'payment_provider' => $provider,
+                'external_order_id' => $orderID,
+                'external_customer_id' => $customerID,
             ]);
             if ($queueDelivery) {
                 LicenseDeliveryOutbox::updateOrCreate(
-                    ['license_id'=>$license->id],
-                    ['encrypted_license_key'=>Crypt::encryptString($plain),'recipient_email'=>$license->customer_email,'delivered_at'=>null]
+                    ['license_id' => $license->id],
+                    ['encrypted_license_key' => Crypt::encryptString($plain), 'recipient_email' => $license->customer_email, 'delivered_at' => null]
                 );
             }
+
             return [$license, $plain];
         });
     }

rsync-studio-licensing/app/Services/Licensing/LicenseKey.php

@@ -1,4 +1,5 @@
 <?php
+
 namespace App\Services\Licensing;
 
 final class LicenseKey
@@ -7,7 +8,10 @@ final class LicenseKey
     {
         $alphabet = 'ABCDEFGHJKLMNPQRSTUVWXYZ23456789';
         $raw = '';
-        for ($i=0; $i<20; $i++) $raw .= $alphabet[random_int(0, strlen($alphabet)-1)];
+        for ($i = 0; $i < 20; $i++) {
+            $raw .= $alphabet[random_int(0, strlen($alphabet) - 1)];
+        }
+
         return implode('-', str_split($raw, 5));
     }
 

rsync-studio-licensing/app/Services/Licensing/LicenseSigner.php

@@ -1,4 +1,5 @@
 <?php
+
 namespace App\Services\Licensing;
 
 use App\Models\License;
@@ -26,21 +27,28 @@ final class LicenseSigner
         ksort($payload, SORT_STRING);
         $json = json_encode($payload, JSON_UNESCAPED_SLASHES | JSON_THROW_ON_ERROR);
         $sig = sodium_crypto_sign_detached($json, $secret);
+
         return 'RS3.'.self::b64url($json).'.'.self::b64url($sig);
     }
 
     public function publicKeyBase64(): string
     {
         $pair = sodium_crypto_sign_seed_keypair($this->privateSeed());
+
         return base64_encode(sodium_crypto_sign_publickey($pair));
     }
 
     private function privateSeed(): string
     {
         $path = config('rsync-studio.private_key_path');
-        if (!$path || !is_file($path)) throw new RuntimeException('RSYNC_STUDIO_LICENSE_PRIVATE_KEY_PATH is not configured or does not exist.');
+        if (! $path || ! is_file($path)) {
+            throw new RuntimeException('RSYNC_STUDIO_LICENSE_PRIVATE_KEY_PATH is not configured or does not exist.');
+        }
         $decoded = base64_decode(trim((string) file_get_contents($path)), true);
-        if ($decoded === false || strlen($decoded) !== SODIUM_CRYPTO_SIGN_SEEDBYTES) throw new RuntimeException('The Rsync Studio private key must be a Base64-encoded 32-byte Ed25519 seed.');
+        if ($decoded === false || strlen($decoded) !== SODIUM_CRYPTO_SIGN_SEEDBYTES) {
+            throw new RuntimeException('The Rsync Studio private key must be a Base64-encoded 32-byte Ed25519 seed.');
+        }
+
         return $decoded;
     }
 

rsync-studio-licensing/app/Services/Licensing/LicenseTokenVerifier.php

@@ -1,4 +1,5 @@
 <?php
+
 namespace App\Services\Licensing;
 
 use RuntimeException;
@@ -8,21 +9,32 @@ final class LicenseTokenVerifier
     public function verify(string $token): array
     {
         $parts = explode('.', trim($token));
-        if (count($parts) !== 3 || $parts[0] !== 'RS3') throw new RuntimeException('Invalid licence token.');
+        if (count($parts) !== 3 || $parts[0] !== 'RS3') {
+            throw new RuntimeException('Invalid licence token.');
+        }
         $payload = $this->decode($parts[1]);
         $signature = $this->decode($parts[2]);
         $public = base64_decode((string) config('rsync-studio.public_key'), true);
-        if ($public === false || strlen($public) !== SODIUM_CRYPTO_SIGN_PUBLICKEYBYTES) throw new RuntimeException('Server licence public key is invalid.');
-        if (!sodium_crypto_sign_verify_detached($signature, $payload, $public)) throw new RuntimeException('Licence token signature is invalid.');
+        if ($public === false || strlen($public) !== SODIUM_CRYPTO_SIGN_PUBLICKEYBYTES) {
+            throw new RuntimeException('Server licence public key is invalid.');
+        }
+        if (! sodium_crypto_sign_verify_detached($signature, $payload, $public)) {
+            throw new RuntimeException('Licence token signature is invalid.');
+        }
         $decoded = json_decode($payload, true, flags: JSON_THROW_ON_ERROR);
+
         return is_array($decoded) ? $decoded : throw new RuntimeException('Licence token payload is invalid.');
     }
+
     private function decode(string $value): string
     {
         $value = strtr($value, '-_', '+/');
         $value .= str_repeat('=', (4 - strlen($value) % 4) % 4);
         $out = base64_decode($value, true);
-        if ($out === false) throw new RuntimeException('Invalid Base64URL value.');
+        if ($out === false) {
+            throw new RuntimeException('Invalid Base64URL value.');
+        }
+
         return $out;
     }
 }

rsync-studio-licensing/app/Services/Payments/LemonSqueezyWebhookVerifier.php

@@ -1,4 +1,5 @@
 <?php
+
 namespace App\Services\Payments;
 
 use Illuminate\Http\Request;
@@ -10,8 +11,12 @@ final class LemonSqueezyWebhookVerifier implements WebhookVerifier
     {
         $secret = (string) config('rsync-studio.lemon_squeezy.webhook_secret');
         $signature = (string) $request->header('X-Signature');
-        if ($secret === '' || $signature === '') throw new RuntimeException('Lemon Squeezy webhook verification is not configured.');
-        $expected = hash_hmac('sha256',$rawBody,$secret);
-        if (!hash_equals($expected,$signature)) throw new RuntimeException('Lemon Squeezy webhook signature is invalid.');
+        if ($secret === '' || $signature === '') {
+            throw new RuntimeException('Lemon Squeezy webhook verification is not configured.');
+        }
+        $expected = hash_hmac('sha256', $rawBody, $secret);
+        if (! hash_equals($expected, $signature)) {
+            throw new RuntimeException('Lemon Squeezy webhook signature is invalid.');
+        }
     }
 }

rsync-studio-licensing/app/Services/Payments/PaddleClient.php

@@ -0,0 +1,82 @@
+<?php
+
+namespace App\Services\Payments;
+
+use Illuminate\Http\Client\Response;
+use Illuminate\Support\Facades\Http;
+use RuntimeException;
+
+final class PaddleClient
+{
+    public function customer(?string $customerID): ?array
+    {
+        if (! $customerID || ! config('rsync-studio.paddle.api_key')) {
+            return null;
+        }
+
+        $response = $this->request()->get('/customers/'.$customerID);
+
+        if (! $response->successful()) {
+            return null;
+        }
+        $data = $response->json('data');
+
+        return is_array($data) ? $data : null;
+    }
+
+    public function updateSubscriptionPrice(string $subscriptionID, string $priceID): array
+    {
+        $this->requireWritableConfiguration();
+
+        $response = $this->request()->patch('/subscriptions/'.$subscriptionID, [
+            'proration_billing_mode' => 'prorated_immediately',
+            'items' => [[
+                'price_id' => $priceID,
+                'quantity' => 1,
+            ]],
+        ]);
+
+        return $this->subscriptionData($response, 'Paddle could not update the subscription.');
+    }
+
+    public function cancelSubscriptionImmediately(string $subscriptionID): array
+    {
+        $this->requireWritableConfiguration();
+
+        $response = $this->request()->post('/subscriptions/'.$subscriptionID.'/cancel', [
+            'effective_from' => 'immediately',
+        ]);
+
+        return $this->subscriptionData($response, 'Paddle could not cancel the subscription.');
+    }
+
+    private function request()
+    {
+        return Http::baseUrl((string) config('rsync-studio.paddle.api_url'))
+            ->withToken((string) config('rsync-studio.paddle.api_key'))
+            ->acceptJson()
+            ->timeout(15);
+    }
+
+    private function requireWritableConfiguration(): void
+    {
+        if (trim((string) config('rsync-studio.paddle.api_key')) === '') {
+            throw new RuntimeException('Paddle subscription management is not configured.');
+        }
+    }
+
+    private function subscriptionData(Response $response, string $fallback): array
+    {
+        if (! $response->successful()) {
+            $detail = trim((string) ($response->json('error.detail') ?? ''));
+            throw new RuntimeException($detail !== '' ? $detail : $fallback);
+        }
+
+        $data = $response->json('data');
+        if (! is_array($data)) {
+            throw new RuntimeException($fallback);
+        }
+
+        return $data;
+    }
+}

rsync-studio-licensing/app/Services/Payments/PaddleWebhookVerifier.php

@@ -1,4 +1,5 @@
 <?php
+
 namespace App\Services\Payments;
 
 use Illuminate\Http\Request;
@@ -10,15 +11,28 @@ final class PaddleWebhookVerifier implements WebhookVerifier
     {
         $secret = (string) config('rsync-studio.paddle.webhook_secret');
         $header = (string) $request->header('Paddle-Signature');
-        if ($secret === '' || $header === '') throw new RuntimeException('Paddle webhook verification is not configured.');
+        if ($secret === '' || $header === '') {
+            throw new RuntimeException('Paddle webhook verification is not configured.');
+        }
         $parts = [];
-        foreach (explode(';', $header) as $part) { [$k,$v] = array_pad(explode('=',trim($part),2),2,null); if ($k && $v) $parts[$k][]=$v; }
-        $ts = isset($parts['ts'][0]) ? (int)$parts['ts'][0] : 0;
+        foreach (explode(';', $header) as $part) {
+            [$k,$v] = array_pad(explode('=', trim($part), 2), 2, null);
+            if ($k && $v) {
+                $parts[$k][] = $v;
+            }
+        }
+        $ts = isset($parts['ts'][0]) ? (int) $parts['ts'][0] : 0;
         $signatures = $parts['h1'] ?? [];
-        $tolerance = max(1,(int)config('rsync-studio.paddle.timestamp_tolerance',300));
-        if (!$ts || abs(time()-$ts)>$tolerance) throw new RuntimeException('Paddle webhook timestamp is outside the allowed tolerance.');
+        $tolerance = max(1, (int) config('rsync-studio.paddle.timestamp_tolerance', 300));
+        if (! $ts || abs(time() - $ts) > $tolerance) {
+            throw new RuntimeException('Paddle webhook timestamp is outside the allowed tolerance.');
+        }
         $expected = hash_hmac('sha256', $ts.':'.$rawBody, $secret);
-        foreach ($signatures as $signature) if (hash_equals($expected,$signature)) return;
+        foreach ($signatures as $signature) {
+            if (hash_equals($expected, $signature)) {
+                return;
+            }
+        }
         throw new RuntimeException('Paddle webhook signature is invalid.');
     }
 }

rsync-studio-licensing/app/Services/Payments/PurchaseProvisioner.php

@@ -1,47 +1,246 @@
 <?php
+
 namespace App\Services\Payments;
 
 use App\Models\License;
 use App\Models\LicenseProduct;
 use App\Services\Licensing\LicenseIssuer;
+use Illuminate\Support\Carbon;
 use RuntimeException;
 
 final class PurchaseProvisioner
 {
-    public function __construct(private LicenseIssuer $issuer) {}
+    public function __construct(private LicenseIssuer $issuer, private PaddleClient $paddle) {}
 
     public function provision(string $provider, array $event): void
     {
-        $normalized = match ($provider) {
-            'paddle' => $this->fromPaddle($event),
-            'lemon-squeezy' => $this->fromLemonSqueezy($event),
-            default => throw new RuntimeException('Unsupported payment provider.'),
-        };
-        if ($normalized['action'] === 'ignore') return;
-        if ($normalized['action'] === 'revoke') {
-            License::where('payment_provider',$provider)->where('external_order_id',$normalized['orderID'])->whereNull('revoked_at')->update(['revoked_at'=>now(),'revoke_reason'=>'Payment refunded or reversed']);
+        if ($provider === 'paddle') {
+            $this->provisionPaddle($event);
+
             return;
         }
-        $product = LicenseProduct::where('payment_provider',$provider)->where(function($q) use($normalized){ $q->where('external_price_id',$normalized['priceID'])->orWhere('external_product_id',$normalized['productID']); })->where('active',true)->first();
-        if (!$product) throw new RuntimeException('No active licence product maps to this payment item.');
-        $this->issuer->issue($product,$normalized['name'],$normalized['email'],$provider,$normalized['orderID'],$normalized['customerID'], true);
+
+        if ($provider === 'lemon-squeezy') {
+            $this->provisionLemonSqueezy($event);
+
+            return;
+        }
+
+        throw new RuntimeException('Unsupported payment provider.');
     }
 
-    private function fromPaddle(array $e): array
+    private function provisionPaddle(array $event): void
     {
-        $type=(string)($e['event_type']??''); $d=$e['data']??[];
-        if (in_array($type,['transaction.refunded','transaction.canceled'],true)) return ['action'=>'revoke','orderID'=>(string)($d['id']??''),'priceID'=>'','productID'=>'','name'=>null,'email'=>null,'customerID'=>null];
-        if ($type!=='transaction.completed') return ['action'=>'ignore'];
-        $item=$d['items'][0]??[]; $price=$item['price']??[]; $product=$price['product_id']??($item['product_id']??null);
-        return ['action'=>'issue','orderID'=>(string)($d['id']??''),'priceID'=>(string)($price['id']??($item['price_id']??'')),'productID'=>(string)($product??''),'name'=>$d['custom_data']['customer_name']??null,'email'=>$d['custom_data']['customer_email']??null,'customerID'=>isset($d['customer_id'])?(string)$d['customer_id']:null];
+        $type = (string) ($event['event_type'] ?? '');
+        $data = $event['data'] ?? [];
+
+        if (str_starts_with($type, 'subscription.')) {
+            $this->syncPaddleSubscription($type, $data);
+
+            return;
+        }
+
+        if ($type === 'transaction.completed') {
+            $this->syncPaddleTransaction($data);
+
+            return;
+        }
+
+        if ($type === 'transaction.refunded') {
+            $transactionID = (string) ($data['id'] ?? '');
+            if ($transactionID !== '') {
+                License::where('payment_provider', 'paddle')
+                    ->where('external_order_id', $transactionID)
+                    ->whereNull('external_subscription_id')
+                    ->whereNull('revoked_at')
+                    ->update(['revoked_at' => now(), 'revoke_reason' => 'Payment refunded']);
+            }
+        }
     }
 
-    private function fromLemonSqueezy(array $e): array
+    private function syncPaddleSubscription(string $type, array $data): void
     {
-        $type=(string)($e['meta']['event_name']??''); $a=$e['data']['attributes']??[];
-        $order=(string)($e['data']['id']??($a['order_id']??''));
-        if (in_array($type,['order_refunded','subscription_expired'],true)) return ['action'=>'revoke','orderID'=>$order,'priceID'=>'','productID'=>'','name'=>null,'email'=>null,'customerID'=>null];
-        if (!in_array($type,['order_created','subscription_created'],true)) return ['action'=>'ignore'];
-        return ['action'=>'issue','orderID'=>$order,'priceID'=>(string)($a['variant_id']??''),'productID'=>(string)($a['product_id']??''),'name'=>$a['user_name']??null,'email'=>$a['user_email']??null,'customerID'=>isset($a['customer_id'])?(string)$a['customer_id']:null];
+        $subscriptionID = (string) ($data['id'] ?? '');
+        if ($subscriptionID === '') {
+            throw new RuntimeException('Paddle subscription webhook has no subscription ID.');
+        }
+
+        $status = (string) ($data['status'] ?? '');
+        $item = $this->firstRecurringItem($data['items'] ?? []);
+        $price = $item['price'] ?? [];
+        $priceID = (string) ($price['id'] ?? $item['price_id'] ?? '');
+        $productID = (string) ($price['product_id'] ?? $item['product_id'] ?? '');
+
+        $license = License::where('payment_provider', 'paddle')
+            ->where('external_subscription_id', $subscriptionID)
+            ->first();
+
+        if (! $license) {
+            $product = $this->mappedProduct('paddle', $priceID, $productID);
+            $custom = is_array($data['custom_data'] ?? null) ? $data['custom_data'] : [];
+            $customer = $this->paddle->customer($this->nullableString($data['customer_id'] ?? null));
+            [$license] = $this->issuer->issue(
+                $product,
+                $this->nullableString($custom['customer_name'] ?? $custom['name'] ?? $customer['name'] ?? null),
+                $this->nullableString($custom['customer_email'] ?? $custom['email'] ?? $customer['email'] ?? null),
+                'paddle',
+                $this->nullableString($data['transaction_id'] ?? null),
+                $this->nullableString($data['customer_id'] ?? null),
+                true,
+            );
+            $license->external_subscription_id = $subscriptionID;
+        } elseif ($priceID !== '' && $priceID !== $license->external_price_id) {
+            // Upgrades/downgrades change the entitlement attached to the existing key.
+            $product = $this->mappedProduct('paddle', $priceID, $productID);
+            $license->license_product_id = $product->id;
+            $license->edition = $product->edition;
+            $license->activation_limit = $product->activation_limit;
+            $license->max_major_version = $product->max_major_version;
+        }
+
+        $periodEnd = $data['current_billing_period']['ends_at'] ?? null;
+        $scheduled = $data['scheduled_change'] ?? null;
+        $cancelAt = is_array($scheduled) && ($scheduled['action'] ?? null) === 'cancel'
+            ? ($scheduled['effective_at'] ?? null)
+            : null;
+
+        $license->external_customer_id = $this->nullableString($data['customer_id'] ?? null) ?? $license->external_customer_id;
+        $license->external_price_id = $priceID !== '' ? $priceID : $license->external_price_id;
+        $license->subscription_status = $status !== '' ? $status : $license->subscription_status;
+        $license->current_period_ends_at = $periodEnd ? Carbon::parse($periodEnd) : $license->current_period_ends_at;
+        $license->cancel_scheduled_at = $cancelAt ? Carbon::parse($cancelAt) : null;
+
+        if (in_array($status, ['active', 'trialing'], true)) {
+            $license->revoked_at = null;
+            $license->revoke_reason = null;
+            // Trialing/active subscriptions remain valid through the current period.
+            $license->expires_at = $periodEnd ? Carbon::parse($periodEnd) : null;
+        } elseif ($status === 'past_due') {
+            // Do not instantly kill a licence on the first failed renewal. Preserve the
+            // period Paddle says is current; a later canceled event ends entitlement.
+            $license->expires_at = $periodEnd ? Carbon::parse($periodEnd) : ($license->expires_at ?? now()->addDays(7));
+        } elseif (in_array($status, ['canceled', 'paused'], true)) {
+            $license->expires_at = now();
+            $license->revoked_at = now();
+            $license->revoke_reason = $status === 'paused' ? 'Subscription paused' : 'Subscription canceled';
+        }
+
+        $license->save();
+    }
+
+    private function syncPaddleTransaction(array $data): void
+    {
+        $subscriptionID = $this->nullableString($data['subscription_id'] ?? null);
+        $transactionID = (string) ($data['id'] ?? '');
+
+        // Recurring purchases are provisioned from subscription events because those
+        // events contain the authoritative trial/status/current-period state.
+        if ($subscriptionID) {
+            License::where('payment_provider', 'paddle')
+                ->where('external_subscription_id', $subscriptionID)
+                ->whereNull('external_order_id')
+                ->update(['external_order_id' => $transactionID ?: null]);
+
+            return;
+        }
+
+        // Keep support for any future one-time Paddle licence product.
+        $item = $data['items'][0] ?? [];
+        $price = $item['price'] ?? [];
+        $priceID = (string) ($price['id'] ?? $item['price_id'] ?? '');
+        $productID = (string) ($price['product_id'] ?? $item['product_id'] ?? '');
+        $product = $this->mappedProduct('paddle', $priceID, $productID);
+        $custom = is_array($data['custom_data'] ?? null) ? $data['custom_data'] : [];
+        $customer = $this->paddle->customer($this->nullableString($data['customer_id'] ?? null));
+
+        $this->issuer->issue(
+            $product,
+            $this->nullableString($custom['customer_name'] ?? $custom['name'] ?? $customer['name'] ?? null),
+            $this->nullableString($custom['customer_email'] ?? $custom['email'] ?? $customer['email'] ?? null),
+            'paddle',
+            $transactionID,
+            $this->nullableString($data['customer_id'] ?? null),
+            true,
+        );
+    }
+
+    private function provisionLemonSqueezy(array $event): void
+    {
+        $type = (string) ($event['meta']['event_name'] ?? '');
+        $attributes = $event['data']['attributes'] ?? [];
+        $order = (string) ($event['data']['id'] ?? $attributes['order_id'] ?? '');
+
+        if (in_array($type, ['order_refunded', 'subscription_expired'], true)) {
+            License::where('payment_provider', 'lemon-squeezy')
+                ->where('external_order_id', $order)
+                ->whereNull('revoked_at')
+                ->update(['revoked_at' => now(), 'revoke_reason' => 'Payment refunded or subscription expired']);
+
+            return;
+        }
+
+        if (! in_array($type, ['order_created', 'subscription_created'], true)) {
+            return;
+        }
+
+        $product = $this->mappedProduct(
+            'lemon-squeezy',
+            (string) ($attributes['variant_id'] ?? ''),
+            (string) ($attributes['product_id'] ?? ''),
+        );
+
+        $this->issuer->issue(
+            $product,
+            $this->nullableString($attributes['user_name'] ?? null),
+            $this->nullableString($attributes['user_email'] ?? null),
+            'lemon-squeezy',
+            $order,
+            $this->nullableString($attributes['customer_id'] ?? null),
+            true,
+        );
+    }
+
+    private function mappedProduct(string $provider, string $priceID, string $productID): LicenseProduct
+    {
+        // Price IDs are the authoritative mapping because monthly and annual prices
+        // intentionally share the same Paddle product ID.
+        if ($priceID !== '') {
+            $product = LicenseProduct::where('payment_provider', $provider)
+                ->where('external_price_id', $priceID)
+                ->where('active', true)
+                ->first();
+        } else {
+            $product = LicenseProduct::where('payment_provider', $provider)
+                ->where('external_product_id', $productID)
+                ->where('active', true)
+                ->first();
+        }
+
+        if (! $product) {
+            throw new RuntimeException("No active licence product maps to {$provider} price {$priceID} / product {$productID}.");
+        }
+
+        return $product;
+    }
+
+    private function firstRecurringItem(array $items): array
+    {
+        foreach ($items as $item) {
+            if (($item['recurring'] ?? true) === true) {
+                return $item;
+            }
+        }
+
+        return $items[0] ?? [];
+    }
+
+    private function nullableString(mixed $value): ?string
+    {
+        if (! is_scalar($value)) {
+            return null;
+        }
+        $value = trim((string) $value);
+
+        return $value === '' ? null : $value;
     }
 }

rsync-studio-licensing/app/Services/Payments/WebhookVerifier.php

@@ -1,4 +1,10 @@
 <?php
+
 namespace App\Services\Payments;
+
 use Illuminate\Http\Request;
-interface WebhookVerifier { public function verify(Request $request, string $rawBody): void; }
+
+interface WebhookVerifier
+{
+    public function verify(Request $request, string $rawBody): void;
+}

rsync-studio-licensing/bootstrap/providers.php

@@ -1,5 +1,7 @@
 <?php
 
+use App\Providers\RsyncStudioLicensingServiceProvider;
+
 return [
-    App\Providers\RsyncStudioLicensingServiceProvider::class,
+    RsyncStudioLicensingServiceProvider::class,
 ];

rsync-studio-licensing/composer.json

@@ -9,7 +9,8 @@
         "php": "^8.3",
         "deployer/deployer": "^8.0",
         "laravel/framework": "^13.17",
-        "laravel/tinker": "^3.0"
+        "laravel/tinker": "^3.0",
+        "predis/predis": "^3.6"
     },
     "require-dev": {
         "fakerphp/faker": "^1.23",

rsync-studio-licensing/composer.lock

@@ -4,7 +4,7 @@
         "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
         "This file is @generated automatically"
     ],
-    "content-hash": "03c9ba92496a9b294eb87b214b3c0df4",
+    "content-hash": "1f5b5a47e5910fdf5b2c47e1bc45e1b0",
     "packages": [
         {
             "name": "brick/math",
@@ -2738,6 +2738,69 @@
             ],
             "time": "2026-08-24T00:54:40+00:00"
         },
+        {
+            "name": "predis/predis",
+            "version": "v3.6.0",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/predis/predis.git",
+                "reference": "2ff20c08bb63697245ffee3f198d1673086c302d"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/predis/predis/zipball/2ff20c08bb63697245ffee3f198d1673086c302d",
+                "reference": "2ff20c08bb63697245ffee3f198d1673086c302d",
+                "shasum": ""
+            },
+            "require": {
+                "php": "^7.2 || ^8.0",
+                "psr/http-message": "^1.0|^2.0"
+            },
+            "require-dev": {
+                "friendsofphp/php-cs-fixer": "^3.3",
+                "phpstan/phpstan": "^1.9",
+                "phpunit/phpcov": "^6.0 || ^8.0",
+                "phpunit/phpunit": "^8.0 || ~9.4.4"
+            },
+            "suggest": {
+                "ext-relay": "Faster connection with in-memory caching (>=0.6.2)"
+            },
+            "type": "library",
+            "autoload": {
+                "psr-4": {
+                    "Predis\\": "src/"
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "authors": [
+                {
+                    "name": "Till Krüss",
+                    "homepage": "https://till.im",
+                    "role": "Maintainer"
+                }
+            ],
+            "description": "A flexible and feature-complete Redis/Valkey client for PHP.",
+            "homepage": "http://github.com/predis/predis",
+            "keywords": [
+                "nosql",
+                "predis",
+                "redis"
+            ],
+            "support": {
+                "issues": "https://github.com/predis/predis/issues",
+                "source": "https://github.com/predis/predis/tree/v3.6.0"
+            },
+            "funding": [
+                {
+                    "url": "https://github.com/sponsors/tillkruss",
+                    "type": "github"
+                }
+            ],
+            "time": "2026-08-14T23:07:56+00:00"
+        },
         {
             "name": "psr/clock",
             "version": "1.0.0",

rsync-studio-licensing/composer.stage4.json

@@ -1,7 +0,0 @@
-{
-  "require": {
-    "php": "^8.3",
-    "ext-sodium": "*",
-    "laravel/framework": "^13.0"
-  }
-}

rsync-studio-licensing/config/rsync-studio.php

@@ -10,9 +10,35 @@ return [
     'purchase_url' => env('RSYNC_STUDIO_PURCHASE_URL'),
     'portal_url' => env('RSYNC_STUDIO_PORTAL_URL'),
     'support_url' => env('RSYNC_STUDIO_SUPPORT_URL'),
+
+    'legal' => [
+        'controller_name' => env('RSYNC_STUDIO_LEGAL_NAME', 'Rsync Studio'),
+        'privacy_email' => env('RSYNC_STUDIO_PRIVACY_EMAIL', env('MAIL_FROM_ADDRESS')),
+        'support_email' => env('RSYNC_STUDIO_SUPPORT_EMAIL', env('MAIL_FROM_ADDRESS')),
+        'country' => env('RSYNC_STUDIO_LEGAL_COUNTRY', 'United Kingdom'),
+    ],
+    'privacy' => [
+        'policy_version' => env('RSYNC_STUDIO_PRIVACY_VERSION', '2026-09-09'),
+        'cookie_version' => env('RSYNC_STUDIO_COOKIE_VERSION', '1'),
+        'support_retention_days' => (int) env('RSYNC_STUDIO_SUPPORT_RETENTION_DAYS', 730),
+    ],
+    'support' => [
+        'alert_emails' => array_values(array_filter(array_map('trim', explode(',', (string) env('RSYNC_STUDIO_SUPPORT_ALERT_EMAILS', ''))))),
+        'notify_admin_users' => filter_var(env('RSYNC_STUDIO_SUPPORT_NOTIFY_ADMINS', true), FILTER_VALIDATE_BOOL),
+    ],
     'paddle' => [
+        'api_key' => env('PADDLE_API_KEY'),
+        'client_side_token' => env('PADDLE_CLIENT_SIDE_TOKEN'),
+        'environment' => env('PADDLE_ENVIRONMENT', env('APP_ENV') === 'production' ? 'production' : 'sandbox'),
+        'api_url' => env('PADDLE_API_URL', env('APP_ENV') === 'production' ? 'https://api.paddle.com' : 'https://sandbox-api.paddle.com'),
         'webhook_secret' => env('PADDLE_WEBHOOK_SECRET'),
         'timestamp_tolerance' => (int) env('PADDLE_WEBHOOK_TOLERANCE', 300),
+        'personal_product_id' => env('PADDLE_PERSONAL_PRODUCT_ID'),
+        'personal_monthly_price_id' => env('PADDLE_PERSONAL_MONTHLY_PRICE_ID'),
+        'personal_annual_price_id' => env('PADDLE_PERSONAL_ANNUAL_PRICE_ID'),
+        'professional_product_id' => env('PADDLE_PROFESSIONAL_PRODUCT_ID'),
+        'professional_monthly_price_id' => env('PADDLE_PROFESSIONAL_MONTHLY_PRICE_ID'),
+        'professional_annual_price_id' => env('PADDLE_PROFESSIONAL_ANNUAL_PRICE_ID'),
     ],
     'lemon_squeezy' => [
         'webhook_secret' => env('LEMON_SQUEEZY_WEBHOOK_SECRET'),

rsync-studio-licensing/database/migrations/2026_09_08_200000_create_rsync_studio_licensing_tables.php

@@ -4,7 +4,8 @@ use Illuminate\Database\Migrations\Migration;
 use Illuminate\Database\Schema\Blueprint;
 use Illuminate\Support\Facades\Schema;
 
-return new class extends Migration {
+return new class extends Migration
+{
     public function up(): void
     {
         Schema::create('license_products', function (Blueprint $table) {

rsync-studio-licensing/database/migrations/2026_09_09_100000_add_paddle_subscription_fields.php

@@ -0,0 +1,34 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('licenses', function (Blueprint $table) {
+            $table->string('external_subscription_id')->nullable()->after('external_customer_id');
+            $table->string('external_price_id')->nullable()->after('external_subscription_id');
+            $table->string('subscription_status')->nullable()->after('external_price_id');
+            $table->timestamp('current_period_ends_at')->nullable()->after('subscription_status');
+            $table->timestamp('cancel_scheduled_at')->nullable()->after('current_period_ends_at');
+            $table->unique(['payment_provider', 'external_subscription_id']);
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('licenses', function (Blueprint $table) {
+            $table->dropUnique(['payment_provider', 'external_subscription_id']);
+            $table->dropColumn([
+                'external_subscription_id',
+                'external_price_id',
+                'subscription_status',
+                'current_period_ends_at',
+                'cancel_scheduled_at',
+            ]);
+        });
+    }
+};

rsync-studio-licensing/database/migrations/2026_09_09_160000_create_support_tickets_and_notifications.php

@@ -0,0 +1,47 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        if (! Schema::hasTable('support_tickets')) {
+            Schema::create('support_tickets', function (Blueprint $table): void {
+                $table->id();
+                $table->foreignId('user_id')->nullable()->constrained()->nullOnDelete();
+                $table->foreignId('assigned_to')->nullable()->constrained('users')->nullOnDelete();
+                $table->string('reference', 24)->unique();
+                $table->string('name', 120);
+                $table->string('email', 254)->index();
+                $table->string('category', 40)->default('general');
+                $table->string('subject', 180);
+                $table->text('message');
+                $table->string('status', 20)->default('new')->index();
+                $table->string('priority', 20)->default('normal');
+                $table->timestamp('privacy_notice_accepted_at');
+                $table->timestamp('resolved_at')->nullable()->index();
+                $table->timestamps();
+            });
+        }
+
+        if (! Schema::hasTable('notifications')) {
+            Schema::create('notifications', function (Blueprint $table): void {
+                $table->uuid('id')->primary();
+                $table->string('type');
+                $table->morphs('notifiable');
+                $table->text('data');
+                $table->timestamp('read_at')->nullable();
+                $table->timestamps();
+            });
+        }
+    }
+
+    public function down(): void
+    {
+        Schema::dropIfExists('support_tickets');
+        Schema::dropIfExists('notifications');
+    }
+};

rsync-studio-licensing/database/seeders/PaddleCatalogSeeder.php

@@ -0,0 +1,29 @@
+<?php
+
+namespace Database\Seeders;
+
+use App\Models\LicenseProduct;
+use Illuminate\Database\Seeder;
+
+class PaddleCatalogSeeder extends Seeder
+{
+    public function run(): void
+    {
+        $products = [
+            ['code' => 'personal-monthly', 'name' => 'Rsync Studio Personal Monthly', 'edition' => 'Personal', 'activation_limit' => 1, 'external_product_id' => config('rsync-studio.paddle.personal_product_id'), 'external_price_id' => config('rsync-studio.paddle.personal_monthly_price_id')],
+            ['code' => 'personal-annual', 'name' => 'Rsync Studio Personal Annual', 'edition' => 'Personal', 'activation_limit' => 1, 'external_product_id' => config('rsync-studio.paddle.personal_product_id'), 'external_price_id' => config('rsync-studio.paddle.personal_annual_price_id')],
+            ['code' => 'professional-monthly', 'name' => 'Rsync Studio Professional Monthly', 'edition' => 'Professional', 'activation_limit' => 3, 'external_product_id' => config('rsync-studio.paddle.professional_product_id'), 'external_price_id' => config('rsync-studio.paddle.professional_monthly_price_id')],
+            ['code' => 'professional-annual', 'name' => 'Rsync Studio Professional Annual', 'edition' => 'Professional', 'activation_limit' => 3, 'external_product_id' => config('rsync-studio.paddle.professional_product_id'), 'external_price_id' => config('rsync-studio.paddle.professional_annual_price_id')],
+        ];
+
+        foreach ($products as $data) {
+            if (! $data['external_product_id'] || ! $data['external_price_id']) {
+                continue;
+            }
+            LicenseProduct::updateOrCreate(
+                ['code' => $data['code']],
+                $data + ['payment_provider' => 'paddle', 'max_major_version' => config('rsync-studio.default_max_major_version'), 'active' => true]
+            );
+        }
+    }
+}

rsync-studio-licensing/deploy.php

@@ -9,7 +9,7 @@ set('writable_use_sudo', true);
 set('clear_use_sudo', true);
 set('cleanup_use_sudo', true);
 set('keep_releases', 1);
-set('repository', 'git@git.absdev.net:admin/RSync-Studio.git');
+set('repository', 'git@git.absdev.net:mag/rsync_licensing_server.git');
 set('node_version', '22.12.0');
 set('allow_anonymous_stats', false);
 
@@ -18,8 +18,8 @@ add('shared_dirs', ['storage']);
 add('writable_dirs', ['storage', 'bootstrap/cache']);
 
 // Host Definitions
-host('main')
-    ->set('hostname', 'rsyncstudio.absdev.net')
+host('prod')
+    ->set('hostname', 'rsyncs.absdev.net')
     ->set('remote_user', 'mag')
     ->set('branch', 'main')
     ->set('deploy_path', '/var/www/rsyncstudio');
@@ -28,7 +28,7 @@ host('stage')
     ->set('hostname', 'pegasus.absdev.net')
     ->set('remote_user', 'mag')
     ->set('branch', 'stage')
-    ->set('deploy_path', '/var/www/rsyncstudio');
+    ->set('deploy_path', '/var/www/rsyncstudio_dev');
 
 task('build', function (): void {
     run('export NVM_DIR="$HOME/.nvm" && [ -s "$NVM_DIR/nvm.sh" ] && . "$NVM_DIR/nvm.sh" && nvm use {{node_version}} && cd {{release_path}} && npm ci --no-audit --no-fund');
@@ -50,7 +50,21 @@ task('artisan:clear', function (): void {
 task('services:restart', function (): void {
     run('sudo -n nginx -t');
     run('sudo -n systemctl reload nginx');
-    run('sudo -n systemctl restart php8.3-fpm');
+    $phpFpm = run(<<<'BASH'
+        if systemctl list-unit-files php8.5-fpm.service --no-legend | grep -q '^php8.5-fpm.service'; then
+            echo php8.5-fpm
+        elif systemctl list-unit-files php8.3-fpm.service --no-legend | grep -q '^php8.3-fpm.service'; then
+            echo php8.3-fpm
+        else
+            exit 1
+        fi
+    BASH);
+    $phpFpm = trim($phpFpm);
+    if ($phpFpm === '') {
+        throw new \RuntimeException('No supported PHP-FPM service found (8.5 or 8.3).');
+    }
+    writeln("Restarting {$phpFpm}...");
+    run("sudo -n systemctl restart {$phpFpm}");
 });
 
 after('deploy:update_code', 'deploy:write_revision_file');

rsync-studio-licensing/docs/PADDLE_SUBSCRIPTIONS.md

@@ -0,0 +1,71 @@
+# Paddle subscription integration
+
+## Sandbox configuration
+
+Keep the Paddle API key and webhook secret server-side only. Do not put either value in the macOS application or commit them to Git.
+
+Required environment variables:
+
+```dotenv
+PADDLE_API_KEY=pdl_sdbx_apikey_...
+PADDLE_API_URL=https://sandbox-api.paddle.com
+PADDLE_WEBHOOK_SECRET=...
+
+PADDLE_PERSONAL_PRODUCT_ID=pro_01m22q4c3vt7yvtv3h3zw1jbn0
+PADDLE_PERSONAL_MONTHLY_PRICE_ID=pri_01m22q4cjx177krcpvdph7e2vy
+PADDLE_PERSONAL_ANNUAL_PRICE_ID=pri_01m22q4cs9sr5gshxp6j56nvmh
+PADDLE_PROFESSIONAL_PRODUCT_ID=pro_01m22q4d0s6y1557wsq9s7xw8n
+PADDLE_PROFESSIONAL_MONTHLY_PRICE_ID=pri_01m22q4d6h1yvr1frawtx51gy8
+PADDLE_PROFESSIONAL_ANNUAL_PRICE_ID=pri_01m22q4dcndcdbzc20txadaz52
+```
+
+Then run:
+
+```bash
+php artisan migrate
+php artisan db:seed --class=Database\\Seeders\\PaddleCatalogSeeder
+php artisan config:clear
+```
+
+The seeder maps the four Paddle price IDs to licensing entitlements. Personal permits one active Mac; Professional permits three.
+
+## Paddle notification destination
+
+Configure the sandbox notification destination to POST to:
+
+`https://YOUR-HOST/api/v1/webhooks/paddle`
+
+Copy the destination endpoint secret into `PADDLE_WEBHOOK_SECRET`.
+
+Subscribe to at least:
+
+- `subscription.created`
+- `subscription.updated`
+- `subscription.activated`
+- `subscription.trialing`
+- `subscription.canceled`
+- `subscription.paused`
+- `subscription.resumed`
+- `subscription.past_due`
+- `transaction.completed`
+- `transaction.refunded`
+
+## Entitlement behavior
+
+- Trialing and active subscriptions are usable.
+- A scheduled end-of-period cancellation stays usable until Paddle changes the subscription to canceled.
+- Upgrades/downgrades update the entitlement on the existing licence key.
+- Canceled or paused subscriptions revoke the licence.
+- Past-due subscriptions retain access through Paddle's current billing period rather than being revoked on the first failed payment.
+- Paddle customer details are fetched server-side when the webhook does not carry customer email/name in custom data.
+
+## Important
+
+The API key is required only on the licensing server. Use a sandbox key with the sandbox API URL. Live Paddle products/prices have different IDs and should be configured separately when moving to production.
+
+
+## Hosted sandbox checkout
+
+The licensing site exposes `/buy`, which initializes Paddle.js with `PADDLE_CLIENT_SIDE_TOKEN` and opens an overlay checkout for the four configured price IDs. Set `PADDLE_ENVIRONMENT=sandbox` while testing and use a `test_...` client-side token. The token is intentionally browser-visible; never use `PADDLE_API_KEY` in frontend code.
+
+After a subscription webhook provisions a licence, the webhook controller makes a best-effort attempt to deliver pending licence keys by email. Delivery failures do not roll back the verified Paddle event; the encrypted outbox remains available for portal resend.

rsync-studio-licensing/docs/PORTAL_LAUNCH_FRONTEND.md

@@ -0,0 +1,24 @@
+# Rsync Studio launch frontend
+
+The public `/` page is now a product-launch landing page using the same shared Laravel layout as checkout, support, authentication and the licence portal.
+
+## Favicon/device assets
+
+The website uses the existing Rsync Studio app icon as the web brand source and includes:
+
+- multi-resolution `public/favicon.ico`
+- 16x16, 32x32 and 48x48 browser favicons
+- 180x180 Apple touch icon
+- 192x192 and 512x512 Android/PWA icons
+- Windows 150x150 tile icon and `browserconfig.xml`
+- Safari pinned-tab mask icon
+- `site.webmanifest`
+- Open Graph/Twitter image metadata
+
+The shared `resources/views/layouts/app.blade.php` loads these assets on every website page.
+
+## Launch page
+
+`resources/views/portal/welcome.blade.php` contains the public product page: hero, native app preview, features, workflow, security positioning, Personal/Professional plan summary and trial calls-to-action.
+
+Non-production environments automatically emit `noindex,nofollow`; production emits normal index/follow metadata.

rsync-studio-licensing/docs/rsync-studio-paddle-ids.env

@@ -0,0 +1,7 @@
+PADDLE_PERSONAL_PRODUCT_ID=pro_01m22q4c3vt7yvtv3h3zw1jbn0
+PADDLE_PERSONAL_MONTHLY_PRICE_ID=pri_01m22q4cjx177krcpvdph7e2vy
+PADDLE_PERSONAL_ANNUAL_PRICE_ID=pri_01m22q4cs9sr5gshxp6j56nvmh
+
+PADDLE_PROFESSIONAL_PRODUCT_ID=pro_01m22q4d0s6y1557wsq9s7xw8n
+PADDLE_PROFESSIONAL_MONTHLY_PRICE_ID=pri_01m22q4d6h1yvr1frawtx51gy8
+PADDLE_PROFESSIONAL_ANNUAL_PRICE_ID=pri_01m22q4dcndcdbzc20txadaz52

rsync-studio-licensing/public/browserconfig.xml

@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="utf-8"?>
+<browserconfig>
+  <msapplication>
+    <tile>
+      <square150x150logo src="/icons/mstile-150x150.png"/>
+      <TileColor>#2563eb</TileColor>
+    </tile>
+  </msapplication>
+</browserconfig>

rsync-studio-licensing/public/icons/safari-pinned-tab.svg

@@ -0,0 +1,3 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512">
+  <path fill="#000" d="M256 89c85 0 154 60 167 139l-46 8c-9-56-60-100-121-100-45 0-85 24-106 60l41 15-83 36-33-85 31 12C135 123 191 89 256 89Zm0 334c-85 0-154-60-167-139l46-8c9 56 60 100 121 100 45 0 85-24 106-60l-41-15 83-36 33 85-31-12c-29 51-85 85-150 85Zm-69-192h138v25H187v-25Zm0 55h138v25H187v-25Z"/>
+</svg>

rsync-studio-licensing/public/site.webmanifest

@@ -0,0 +1,13 @@
+{
+  "name": "Rsync Studio",
+  "short_name": "Rsync Studio",
+  "description": "Native rsync job management for macOS.",
+  "start_url": "/",
+  "display": "standalone",
+  "background_color": "#f7f9fc",
+  "theme_color": "#0b1220",
+  "icons": [
+    {"src": "/icons/android-chrome-192x192.png", "sizes": "192x192", "type": "image/png"},
+    {"src": "/icons/android-chrome-512x512.png", "sizes": "512x512", "type": "image/png"}
+  ]
+}

rsync-studio-licensing/resources/views/admin/index.blade.php

@@ -1 +1,6 @@
-@extends('layouts.app') @section('content')<h1>Licensing administration</h1><div class="grid"><div class="card"><strong>{{ $licenseCount }}</strong><p>Licences</p></div><div class="card"><strong>{{ $activeCount }}</strong><p>Not revoked</p></div><div class="card"><strong>{{ $activationCount }}</strong><p>Active installations</p></div><div class="card"><strong>{{ $userCount }}</strong><p>Portal users</p></div></div><a class="btn" href="{{ route('admin.licenses') }}">Manage licences</a>@endsection
+@extends('layouts.app')
+@section('content')
+<section class="portal-header"><div><span class="eyebrow">Admin</span><h1>Licensing administration</h1><p class="lead compact">Manage licences, activations and customer support.</p></div></section>
+<div class="grid"><div class="card"><strong>{{ $licenseCount }}</strong><p>Licences</p></div><div class="card"><strong>{{ $activeCount }}</strong><p>Not revoked</p></div><div class="card"><strong>{{ $activationCount }}</strong><p>Active installations</p></div><div class="card"><strong>{{ $userCount }}</strong><p>Portal users</p></div></div>
+<div style="display:flex;gap:10px;flex-wrap:wrap;margin-top:18px"><a class="btn" href="{{ route('admin.licenses') }}">Manage licences</a><a class="btn btn-secondary" href="{{ route('admin.support.index') }}">Support inbox</a></div>
+@endsection

rsync-studio-licensing/resources/views/admin/support/index.blade.php

@@ -0,0 +1,24 @@
+@extends('layouts.app', ['title' => 'Support Inbox — Rsync Studio'])
+@section('content')
+<section class="portal-header"><div><span class="eyebrow">Admin</span><h1>Support inbox</h1><p class="lead compact">Customer, licence, billing and privacy requests.</p></div></section>
+<form method="get" class="filter-bar">
+    <label for="status">Status</label>
+    <select id="status" name="status" onchange="this.form.submit()">
+        <option value="">All</option>
+        @foreach(['new','open','waiting','resolved','closed'] as $status)<option value="{{ $status }}" @selected(request('status') === $status)>{{ ucfirst($status) }}</option>@endforeach
+    </select>
+</form>
+<div class="admin-ticket-list">
+@forelse($tickets as $ticket)
+    <a class="admin-ticket-row" href="{{ route('admin.support.show', $ticket) }}">
+        <div><span class="ticket-ref">{{ $ticket->reference }}</span><strong>{{ $ticket->subject }}</strong><small>{{ $ticket->name }} · {{ $ticket->email }}</small></div>
+        <span class="ticket-category">{{ ucfirst($ticket->category) }}</span>
+        <span class="ticket-status status-{{ $ticket->status }}">{{ ucfirst($ticket->status) }}</span>
+        <time>{{ $ticket->created_at->diffForHumans() }}</time>
+    </a>
+@empty
+    <div class="empty-state"><h2>No support requests</h2><p>The support inbox is empty.</p></div>
+@endforelse
+</div>
+{{ $tickets->links() }}
+@endsection

rsync-studio-licensing/resources/views/admin/support/show.blade.php

@@ -0,0 +1,14 @@
+@extends('layouts.app', ['title' => $ticket->reference.' — Support'])
+@section('content')
+<a class="back-link" href="{{ route('admin.support.index') }}">← Support inbox</a>
+<section class="ticket-detail-head"><div><span class="ticket-ref">{{ $ticket->reference }}</span><h1>{{ $ticket->subject }}</h1><p>{{ $ticket->name }} · <a href="mailto:{{ $ticket->email }}?subject=Re:%20{{ rawurlencode($ticket->reference.' '.$ticket->subject) }}">{{ $ticket->email }}</a></p></div><span class="ticket-status status-{{ $ticket->status }}">{{ ucfirst($ticket->status) }}</span></section>
+<div class="detail-grid">
+    <article class="panel ticket-message"><h2>Request</h2><div class="ticket-meta"><span>{{ ucfirst($ticket->category) }}</span><span>{{ $ticket->created_at->format('j M Y H:i') }}</span></div><div class="message-body">{!! nl2br(e($ticket->message)) !!}</div><a class="btn btn-primary" href="mailto:{{ $ticket->email }}?subject=Re:%20{{ rawurlencode($ticket->reference.' '.$ticket->subject) }}">Reply by email</a></article>
+    <aside class="panel"><h2>Manage</h2><form method="post" action="{{ route('admin.support.update', $ticket) }}">@csrf @method('PATCH')
+        <label>Status<select name="status">@foreach(['new','open','waiting','resolved','closed'] as $status)<option value="{{ $status }}" @selected($ticket->status === $status)>{{ ucfirst($status) }}</option>@endforeach</select></label>
+        <label>Priority<select name="priority">@foreach(['low','normal','high','urgent'] as $priority)<option value="{{ $priority }}" @selected($ticket->priority === $priority)>{{ ucfirst($priority) }}</option>@endforeach</select></label>
+        <label>Assigned to<select name="assigned_to"><option value="">Unassigned</option>@foreach($admins as $admin)<option value="{{ $admin->id }}" @selected($ticket->assigned_to === $admin->id)>{{ $admin->name }} — {{ $admin->email }}</option>@endforeach</select></label>
+        <button class="full-width">Save changes</button>
+    </form></aside>
+</div>
+@endsection

rsync-studio-licensing/resources/views/checkout/buy.blade.php

@@ -0,0 +1,91 @@
+@extends('layouts.app')
+@section('content')
+<div class="hero-card">
+    <span class="eyebrow">Rsync Studio</span>
+    <h1>Choose your licence</h1>
+    <p class="lead">Every subscription starts with a 7-day free trial. Cancel before the trial ends and you won't be charged.</p>
+    @if($paddleEnvironment === 'sandbox')<div class="sandbox-badge">Sandbox checkout — no real payment is taken</div>@endif
+</div>
+
+<div class="pricing-grid">
+@foreach($plans as $code => $plan)
+    <article class="price-card {{ str_starts_with($code, 'professional') ? 'featured' : '' }}">
+        <div>
+            <div class="plan-heading">
+                <div>
+                    <h2>{{ $plan['name'] }}</h2>
+                    <div class="muted">{{ $plan['billing'] }} billing</div>
+                </div>
+                @if($plan['billing'] === 'Annual')<span class="pill">Best value</span>@endif
+            </div>
+            <div class="price" data-price-display="{{ $plan['price_id'] }}" data-billing="{{ strtolower($plan['billing']) }}">{{ $plan['display_price'] }}</div>
+            <ul class="features">
+                <li>7-day free trial</li>
+                <li>{{ $plan['activation_limit'] }} active Mac{{ $plan['activation_limit'] === 1 ? '' : 's' }}</li>
+                <li>Secure online activation</li>
+                <li>Licence management portal</li>
+            </ul>
+        </div>
+        <button class="checkout-button" type="button" data-price-id="{{ $plan['price_id'] }}" data-plan="{{ $plan['name'] }} {{ $plan['billing'] }}">Start free trial</button>
+    </article>
+@endforeach
+</div>
+
+<div class="card checkout-status" id="checkout-status" hidden>
+    <h2>Purchase received</h2>
+    <p>Paddle is confirming your subscription. Your Rsync Studio licence key will be sent to the email used at checkout. You can then activate it in <strong>Rsync Studio → Settings → Licence</strong>.</p>
+    <p class="muted">If the email takes a moment, wait for the Paddle confirmation and check your junk folder. You can also create a portal account with the same email address.</p>
+    <a class="btn" href="{{ route('register') }}">Create portal account</a>
+</div>
+
+<script src="https://cdn.paddle.com/paddle/v2/paddle.js"></script>
+<script>
+(() => {
+    const token = @json($paddleToken);
+    const environment = @json($paddleEnvironment);
+    if (environment === 'sandbox') Paddle.Environment.set('sandbox');
+    Paddle.Initialize({
+        token,
+        eventCallback(event) {
+            if (event && event.name === 'checkout.completed') {
+                document.getElementById('checkout-status').hidden = false;
+                document.getElementById('checkout-status').scrollIntoView({behavior: 'smooth', block: 'center'});
+            }
+        }
+    });
+
+    const priceElements = new Map(
+        Array.from(document.querySelectorAll('[data-price-display]')).map(element => [element.dataset.priceDisplay, element])
+    );
+    const previewItems = Array.from(priceElements.keys()).map(priceId => ({priceId, quantity: 1}));
+    Paddle.PricePreview({items: previewItems}).then(result => {
+        for (const item of (result?.data?.details?.lineItems ?? [])) {
+            const element = priceElements.get(item?.price?.id);
+            const formatted = item?.formattedTotals?.subtotal ?? item?.formattedUnitTotals?.subtotal;
+            if (!element || !formatted) continue;
+            const suffix = element.dataset.billing === 'annual' ? ' / year' : ' / month';
+            element.textContent = formatted + suffix;
+        }
+    }).catch(() => {
+        // Keep the server-rendered GBP fallback if Paddle pricing preview is unavailable.
+    });
+
+    document.querySelectorAll('.checkout-button').forEach(button => {
+        button.addEventListener('click', () => {
+            Paddle.Checkout.open({
+                items: [{priceId: button.dataset.priceId, quantity: 1}],
+                settings: {
+                    displayMode: 'overlay',
+                    theme: window.matchMedia('(prefers-color-scheme: dark)').matches ? 'dark' : 'light',
+                    allowLogout: false
+                },
+                customData: {
+                    source: 'rsync-studio-buy-page',
+                    plan: button.dataset.plan
+                }
+            });
+        });
+    });
+})();
+</script>
+@endsection

rsync-studio-licensing/resources/views/layouts/app.blade.php

@@ -1 +1,315 @@
-<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="csrf-token" content="{{ csrf_token() }}"><title>{{ $title ?? 'Rsync Studio' }}</title><style>body{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",sans-serif;margin:0;background:#f5f6f8;color:#18202a}nav{background:#111827;color:#fff;padding:14px 24px;display:flex;gap:18px;align-items:center}nav a{color:#fff;text-decoration:none}.wrap{max-width:980px;margin:32px auto;padding:0 20px}.card{background:#fff;border:1px solid #d9dee7;border-radius:12px;padding:22px;margin:16px 0;box-shadow:0 2px 8px #0000000d}.grid{display:grid;grid-template-columns:repeat(auto-fit,minmax(180px,1fr));gap:14px}.muted{color:#667085}.ok{color:#067647}.bad{color:#b42318}button,.btn{display:inline-block;border:0;border-radius:8px;padding:10px 14px;background:#2563eb;color:#fff;text-decoration:none;cursor:pointer}button.danger{background:#b42318}input{width:100%;box-sizing:border-box;padding:10px;border:1px solid #cbd5e1;border-radius:8px;margin:6px 0 14px}label{font-weight:600}table{width:100%;border-collapse:collapse}th,td{text-align:left;padding:10px;border-bottom:1px solid #e5e7eb}.alert{padding:12px;border-radius:8px;background:#ecfdf3;margin-bottom:14px}.error{padding:12px;border-radius:8px;background:#fef3f2;margin-bottom:14px}</style></head><body><nav><strong>Rsync Studio</strong><a href="{{ route('home') }}">Home</a>@auth @if(auth()->user()->hasVerifiedEmail())<a href="{{ route('portal.index') }}">My licences</a>@endif @if(auth()->user()->is_admin)<a href="{{ route('admin.index') }}">Admin</a>@endif <span style="margin-left:auto">{{ auth()->user()->email }}</span><form method="post" action="{{ route('logout') }}">@csrf<button>Sign out</button></form>@else<span style="margin-left:auto"></span><a href="{{ route('login') }}">Sign in</a><a href="{{ route('register') }}">Create account</a>@endauth</nav><main class="wrap">@if(session('status'))<div class="alert">{{ session('status') }}</div>@endif @if($errors->any())<div class="error">{{ $errors->first() }}</div>@endif @yield('content')</main></body></html>
+<!doctype html>
+<html lang="en">
+<head>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width,initial-scale=1,viewport-fit=cover">
+    <meta name="csrf-token" content="{{ csrf_token() }}">
+
+    @php
+        $pageTitle = $title ?? 'Rsync Studio';
+        $pageDescription = $description ?? 'Native rsync job management for macOS. Create, schedule, watch and review reliable local and SSH sync jobs.';
+        $canonicalUrl = url()->current();
+        $socialImage = url('/icons/og-rsync-studio.png');
+    @endphp
+
+    <title>{{ $pageTitle }}</title>
+    <meta name="description" content="{{ $pageDescription }}">
+    <meta name="theme-color" content="#0b1220">
+    <meta name="application-name" content="Rsync Studio">
+    <meta name="apple-mobile-web-app-title" content="Rsync Studio">
+    <meta name="apple-mobile-web-app-capable" content="yes">
+    <meta name="apple-mobile-web-app-status-bar-style" content="black-translucent">
+    <meta name="msapplication-TileColor" content="#2563eb">
+    <meta name="msapplication-config" content="{{ asset('browserconfig.xml') }}">
+    @if(app()->environment('production'))
+        <meta name="robots" content="index,follow,max-image-preview:large">
+    @else
+        <meta name="robots" content="noindex,nofollow">
+    @endif
+
+    <link rel="canonical" href="{{ $canonicalUrl }}">
+    <link rel="icon" href="{{ asset('favicon.ico') }}" sizes="any">
+    <link rel="icon" type="image/png" sizes="32x32" href="{{ asset('icons/favicon-32x32.png') }}">
+    <link rel="icon" type="image/png" sizes="16x16" href="{{ asset('icons/favicon-16x16.png') }}">
+    <link rel="apple-touch-icon" sizes="180x180" href="{{ asset('icons/apple-touch-icon.png') }}">
+    <link rel="mask-icon" href="{{ asset('icons/safari-pinned-tab.svg') }}" color="#2563eb">
+    <link rel="manifest" href="{{ asset('site.webmanifest') }}">
+
+    <meta property="og:type" content="website">
+    <meta property="og:site_name" content="Rsync Studio">
+    <meta property="og:title" content="{{ $pageTitle }}">
+    <meta property="og:description" content="{{ $pageDescription }}">
+    <meta property="og:url" content="{{ $canonicalUrl }}">
+    <meta property="og:image" content="{{ $socialImage }}">
+    <meta property="og:image:width" content="512">
+    <meta property="og:image:height" content="512">
+    <meta name="twitter:card" content="summary">
+    <meta name="twitter:title" content="{{ $pageTitle }}">
+    <meta name="twitter:description" content="{{ $pageDescription }}">
+    <meta name="twitter:image" content="{{ $socialImage }}">
+
+    <style>
+        :root{
+            color-scheme:light;
+            --bg:#f7f9fc;--surface:#fff;--surface-soft:#f8fafc;--text:#172033;--muted:#667085;
+            --line:#e4e7ec;--line-strong:#d0d5dd;--blue:#2563eb;--blue-dark:#1d4ed8;--blue-soft:#eff6ff;
+            --green:#067647;--green-soft:#ecfdf3;--red:#b42318;--red-soft:#fef3f2;--nav:#0b1220;
+            --shadow-sm:0 1px 3px rgba(16,24,40,.06);--shadow-md:0 14px 36px rgba(15,23,42,.08);
+        }
+        *{box-sizing:border-box}
+        html{scroll-behavior:smooth}
+        body{font-family:-apple-system,BlinkMacSystemFont,"SF Pro Text","Segoe UI",sans-serif;margin:0;background:var(--bg);color:var(--text);font-size:15px;line-height:1.5;-webkit-font-smoothing:antialiased}
+        a{color:inherit}
+        img{max-width:100%;display:block}
+        button,input{font:inherit}
+        :focus-visible{outline:3px solid rgba(37,99,235,.28);outline-offset:3px}
+
+        .site-header{position:sticky;top:0;z-index:50;background:rgba(11,18,32,.94);backdrop-filter:saturate(180%) blur(18px);border-bottom:1px solid rgba(255,255,255,.08)}
+        .nav-shell{max-width:1220px;margin:0 auto;min-height:68px;padding:0 24px;display:flex;align-items:center;gap:28px}
+        .brand{display:inline-flex;align-items:center;gap:10px;color:#fff;text-decoration:none;font-weight:800;letter-spacing:-.01em;white-space:nowrap}
+        .brand img{width:34px;height:34px;border-radius:9px;box-shadow:0 5px 14px rgba(37,99,235,.25)}
+        .nav-links{display:flex;align-items:center;gap:22px}
+        .nav-links a{color:#cbd5e1;text-decoration:none;font-weight:650;font-size:14px;transition:color .16s ease}
+        .nav-links a:hover{color:#fff}.nav-alert-count{display:inline-flex;min-width:18px;height:18px;align-items:center;justify-content:center;margin-left:5px;padding:0 5px;border-radius:99px;background:#ef4444;color:#fff;font-size:10px;font-weight:900;vertical-align:1px}
+        .nav-account{margin-left:auto;display:flex;align-items:center;gap:12px;min-width:0}
+        .nav-email{color:#cbd5e1;font-size:13px;max-width:230px;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}
+        .nav-auth-link{color:#e2e8f0;text-decoration:none;font-weight:650;font-size:14px}
+        .nav-cta{display:inline-flex;align-items:center;justify-content:center;padding:9px 13px;border-radius:9px;background:#fff;color:#0f172a!important;text-decoration:none!important;font-weight:800!important}
+        .nav-signout{background:transparent;border:1px solid rgba(255,255,255,.18);color:#e2e8f0;padding:8px 11px;border-radius:9px;font-weight:700;cursor:pointer}
+        .nav-signout:hover{background:rgba(255,255,255,.08)}
+
+        .wrap{max-width:1120px;margin:0 auto;padding:42px 24px 72px;min-height:calc(100vh - 220px)}
+        .wrap-wide{max-width:1220px}
+        .hero-card{padding:28px 0 18px}
+        .hero-card h1,.portal-header h1,.licence-detail-head h1{font-size:38px;line-height:1.08;margin:7px 0 10px;letter-spacing:-.035em}
+        .eyebrow{text-transform:uppercase;letter-spacing:.12em;font-size:11px;font-weight:850;color:var(--blue)}
+        .lead{font-size:17px;line-height:1.62;max-width:720px;color:#475467}.lead.compact{margin:0}
+
+        .btn,button{display:inline-flex;align-items:center;justify-content:center;border:0;border-radius:10px;padding:10px 15px;background:var(--blue);color:#fff;text-decoration:none;cursor:pointer;font:inherit;font-weight:750;line-height:1.2;transition:transform .15s ease,background .15s ease,box-shadow .15s ease}
+        .btn:hover,button:hover{background:var(--blue-dark)}
+        .btn-primary{box-shadow:0 7px 18px rgba(37,99,235,.22)}
+        .btn-primary:hover{transform:translateY(-1px);box-shadow:0 9px 22px rgba(37,99,235,.28)}
+        .btn-secondary,button.btn-secondary{background:#fff;color:#344054;border:1px solid #d0d5dd;box-shadow:none}
+        .btn-secondary:hover,button.btn-secondary:hover{background:#f9fafb}
+        .btn-dark{background:#111827}.btn-dark:hover{background:#030712}
+        .danger{background:var(--red)}.danger:hover{background:#912018}
+        .danger-outline{background:#fff;color:var(--red);border:1px solid #f3b7b2}.danger-outline:hover{background:var(--red-soft)}
+        .full-width{width:100%}
+
+        .pricing-grid{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:18px;margin:20px 0 28px}
+        .price-card,.card,.panel{background:var(--surface);border:1px solid var(--line);border-radius:16px;padding:24px;box-shadow:var(--shadow-sm)}
+        .price-card{display:flex;flex-direction:column;justify-content:space-between;gap:24px}.price-card.featured{border-color:#9dbcf7}
+        .plan-heading{display:flex;align-items:flex-start;justify-content:space-between;gap:10px}.plan-heading h2{margin:0 0 5px}.price{font-size:28px;font-weight:850;margin:20px 0}.features{padding-left:20px;line-height:1.9}
+        .pill,.sandbox-badge{display:inline-block;border-radius:999px;padding:5px 9px;font-size:12px;font-weight:750;background:var(--blue-soft);color:var(--blue-dark)}
+        .sandbox-badge{margin-top:8px;background:#fff7ed;color:#9a3412}.checkout-button{width:100%;font-size:15px;font-weight:750;padding:12px 16px}
+        .grid{display:grid;grid-template-columns:repeat(auto-fit,minmax(180px,1fr));gap:14px}.muted{color:var(--muted)}.ok{color:var(--green)}.bad{color:var(--red)}
+        input{width:100%;padding:11px 12px;border:1px solid #cbd5e1;border-radius:9px;margin:6px 0 14px;background:#fff;color:var(--text)}
+        label{font-weight:650}table{width:100%;border-collapse:collapse}th,td{text-align:left;padding:10px;border-bottom:1px solid #e5e7eb}
+        .alert,.error{padding:13px 15px;border-radius:10px;margin:0 0 20px;font-weight:650}.alert{background:var(--green-soft);color:var(--green);border:1px solid #abefc6}.error{background:var(--red-soft);color:var(--red);border:1px solid #fecdca}
+
+        /* Product launch page */
+        .launch-main{overflow:hidden}
+        .launch-hero{position:relative;background:linear-gradient(180deg,#0b1220 0,#101b31 78%,#f7f9fc 78%);padding:82px 24px 106px;color:#fff}
+        .launch-hero:before{content:"";position:absolute;inset:0;background:radial-gradient(circle at 75% 12%,rgba(59,130,246,.26),transparent 34%),radial-gradient(circle at 18% 32%,rgba(14,165,233,.13),transparent 28%);pointer-events:none}
+        .launch-shell{position:relative;max-width:1220px;margin:0 auto}
+        .hero-grid{display:grid;grid-template-columns:minmax(0,.95fr) minmax(500px,1.05fr);gap:72px;align-items:center}
+        .launch-kicker{display:inline-flex;align-items:center;gap:8px;background:rgba(59,130,246,.12);border:1px solid rgba(147,197,253,.22);color:#bfdbfe;padding:7px 11px;border-radius:999px;font-size:12px;font-weight:800;letter-spacing:.02em}
+        .launch-kicker:before{content:"";width:7px;height:7px;border-radius:50%;background:#60a5fa;box-shadow:0 0 0 4px rgba(96,165,250,.12)}
+        .launch-hero h1{font-size:clamp(46px,6vw,74px);line-height:.98;letter-spacing:-.055em;margin:20px 0 22px;max-width:760px}
+        .hero-copy{font-size:19px;line-height:1.65;color:#cbd5e1;max-width:650px;margin:0}
+        .hero-actions{display:flex;gap:12px;flex-wrap:wrap;margin-top:30px}.hero-actions .btn{padding:13px 18px;border-radius:11px}
+        .hero-actions .btn-secondary{background:rgba(255,255,255,.07);border-color:rgba(255,255,255,.18);color:#fff}.hero-actions .btn-secondary:hover{background:rgba(255,255,255,.12)}
+        .hero-note{margin:16px 0 0;color:#94a3b8;font-size:13px}
+        .trust-row{display:flex;gap:20px;flex-wrap:wrap;margin-top:34px;color:#cbd5e1;font-size:13px}.trust-item{display:flex;align-items:center;gap:7px}.trust-check{display:inline-grid;place-items:center;width:18px;height:18px;border-radius:50%;background:rgba(34,197,94,.12);color:#86efac;font-size:11px;font-weight:900}
+
+        .app-window{border:1px solid rgba(255,255,255,.15);border-radius:18px;background:#f8fafc;box-shadow:0 34px 70px rgba(0,0,0,.32);overflow:hidden;color:#111827;transform:perspective(1200px) rotateY(-2deg) rotateX(1deg);transform-origin:center}
+        .window-bar{height:46px;background:#eef2f7;border-bottom:1px solid #dde3ec;display:flex;align-items:center;padding:0 14px;gap:8px}.dot{width:11px;height:11px;border-radius:50%}.dot.red{background:#ff5f57}.dot.amber{background:#febc2e}.dot.green{background:#28c840}.window-title{margin-left:8px;font-size:12px;font-weight:750;color:#667085}
+        .app-body{display:grid;grid-template-columns:160px 1fr;min-height:390px}.app-sidebar{background:#111827;color:#cbd5e1;padding:18px 12px}.mini-brand{display:flex;align-items:center;gap:8px;color:#fff;font-weight:800;font-size:12px;margin:0 8px 18px}.mini-brand img{width:26px;height:26px;border-radius:7px}.side-item{padding:8px 10px;border-radius:8px;font-size:11px;margin:3px 0}.side-item.active{background:#263244;color:#fff}.app-content{padding:20px;background:#f8fafc}.app-toolbar{display:flex;align-items:center;justify-content:space-between;margin-bottom:16px}.app-toolbar strong{font-size:15px}.sync-all{font-size:10px;background:#2563eb;color:#fff;padding:7px 9px;border-radius:7px;font-weight:800}.mock-job{background:#fff;border:1px solid #e2e8f0;border-radius:11px;padding:13px 14px;margin-bottom:10px;box-shadow:0 1px 2px rgba(15,23,42,.04)}.mock-job-top{display:flex;align-items:center;justify-content:space-between;gap:12px}.mock-job strong{font-size:12px}.job-state{font-size:9px;font-weight:850;padding:4px 7px;border-radius:999px}.state-ready{background:#ecfdf3;color:#047857}.state-scheduled{background:#eff6ff;color:#1d4ed8}.state-watching{background:#f5f3ff;color:#6d28d9}.mock-job p{font-size:9px;color:#64748b;margin:4px 0 9px}.mock-progress{height:5px;background:#eef2f7;border-radius:999px;overflow:hidden}.mock-progress span{display:block;height:100%;border-radius:inherit;background:linear-gradient(90deg,#2563eb,#38bdf8)}.app-statusbar{display:flex;justify-content:space-between;color:#64748b;font-size:9px;margin-top:16px;padding-top:13px;border-top:1px solid #e2e8f0}
+
+        .launch-section{padding:92px 24px}.section-shell{max-width:1120px;margin:0 auto}.section-head{max-width:690px;margin-bottom:42px}.section-head.center{text-align:center;margin-left:auto;margin-right:auto}.section-head h2{font-size:clamp(32px,4vw,46px);line-height:1.08;letter-spacing:-.04em;margin:8px 0 14px}.section-head p{font-size:17px;color:#667085;margin:0;line-height:1.65}
+        .feature-grid{display:grid;grid-template-columns:repeat(3,minmax(0,1fr));gap:18px}.feature-card{background:#fff;border:1px solid var(--line);border-radius:18px;padding:26px;box-shadow:var(--shadow-sm)}.feature-icon{display:grid;place-items:center;width:42px;height:42px;border-radius:11px;background:var(--blue-soft);color:var(--blue);font-weight:900;font-size:18px;margin-bottom:18px}.feature-card h3{font-size:18px;margin:0 0 8px;letter-spacing:-.015em}.feature-card p{color:#667085;margin:0;line-height:1.6}
+        .workflow-section{background:#fff;border-top:1px solid var(--line);border-bottom:1px solid var(--line)}.workflow-grid{display:grid;grid-template-columns:repeat(4,1fr);gap:18px}.workflow-step{position:relative;padding:4px 10px 4px 0}.step-number{display:grid;place-items:center;width:36px;height:36px;border-radius:10px;background:#101828;color:#fff;font-weight:850;margin-bottom:16px}.workflow-step h3{font-size:17px;margin:0 0 7px}.workflow-step p{color:#667085;margin:0;font-size:14px;line-height:1.6}
+        .security-panel{background:#0f172a;color:#fff;border-radius:24px;padding:48px;display:grid;grid-template-columns:.9fr 1.1fr;gap:60px;align-items:center;box-shadow:var(--shadow-md)}.security-panel h2{font-size:38px;line-height:1.08;letter-spacing:-.04em;margin:8px 0 15px}.security-panel p{color:#cbd5e1;font-size:16px;line-height:1.65}.security-list{display:grid;gap:13px}.security-item{display:flex;gap:12px;align-items:flex-start;background:rgba(255,255,255,.055);border:1px solid rgba(255,255,255,.08);border-radius:13px;padding:14px}.security-icon{display:grid;place-items:center;width:30px;height:30px;flex:0 0 30px;border-radius:8px;background:rgba(59,130,246,.17);color:#93c5fd;font-weight:900}.security-item strong{display:block;font-size:14px;margin-bottom:2px}.security-item span{display:block;color:#94a3b8;font-size:12px;line-height:1.5}
+        .plan-grid{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:20px;max-width:860px;margin:0 auto}.launch-plan{background:#fff;border:1px solid var(--line);border-radius:20px;padding:30px;box-shadow:var(--shadow-sm);position:relative}.launch-plan.featured{border-color:#9dbcf7;box-shadow:0 18px 44px rgba(37,99,235,.09)}.launch-plan h3{font-size:23px;margin:0}.launch-plan p{color:#667085}.plan-macs{font-size:34px;font-weight:850;letter-spacing:-.04em;margin:24px 0 3px}.plan-sub{font-size:13px;color:#667085}.plan-list{list-style:none;padding:0;margin:24px 0;display:grid;gap:11px}.plan-list li{display:flex;gap:9px;color:#475467}.plan-list li:before{content:"✓";color:#16a34a;font-weight:900}.launch-plan .btn{width:100%;padding:12px}.best-badge{position:absolute;right:18px;top:18px;background:var(--blue-soft);color:var(--blue-dark);border-radius:999px;padding:5px 9px;font-size:11px;font-weight:850}
+        .launch-cta{padding:30px 24px 100px}.cta-box{max-width:1120px;margin:0 auto;background:linear-gradient(135deg,#2563eb,#1d4ed8 55%,#0f4fc9);color:#fff;border-radius:26px;padding:54px;display:flex;align-items:center;justify-content:space-between;gap:36px;box-shadow:0 24px 54px rgba(37,99,235,.2)}.cta-box h2{font-size:38px;line-height:1.08;letter-spacing:-.04em;margin:0 0 10px}.cta-box p{margin:0;color:#dbeafe;font-size:16px}.cta-box .btn{background:#fff;color:#1e3a8a;padding:13px 18px;white-space:nowrap}.cta-box .btn:hover{background:#eff6ff}
+
+        .portal-header{display:flex;align-items:flex-end;justify-content:space-between;gap:24px;margin-bottom:26px}.licence-list{display:grid;gap:16px}.licence-card{background:#fff;border:1px solid var(--line);border-radius:18px;box-shadow:var(--shadow-sm);overflow:hidden}.licence-card-featured{border-color:#c6d7fb}.licence-main{padding:24px 26px}.licence-title-row{display:flex;align-items:flex-start;justify-content:space-between;gap:20px}.licence-title-row h2{font-size:22px;margin:10px 0 2px;letter-spacing:-.015em}.licence-key{margin:0}.badge-row{display:flex;gap:7px;flex-wrap:wrap}.status-badge,.plan-badge,.billing-badge{display:inline-flex;align-items:center;border-radius:999px;padding:4px 9px;font-size:12px;font-weight:800}.status-active{background:var(--green-soft);color:var(--green)}.status-inactive{background:var(--red-soft);color:var(--red)}.plan-badge{background:var(--blue-soft);color:var(--blue-dark)}.billing-badge{background:#f2f4f7;color:#475467}.licence-stats{display:grid;grid-template-columns:repeat(3,minmax(0,1fr));gap:12px;margin:24px 0 12px;padding-top:20px;border-top:1px solid var(--line)}.licence-stats>div{display:flex;flex-direction:column;gap:3px}.stat-label{font-size:12px;color:var(--muted);font-weight:700;text-transform:uppercase;letter-spacing:.04em}.licence-stats strong{font-size:15px}.activation-meter{height:7px;background:#eef2f6;border-radius:99px;overflow:hidden}.activation-meter span{display:block;height:100%;background:var(--blue);border-radius:99px}.upgrade-strip,.subscription-warning{margin-top:20px;border-radius:12px;padding:15px 16px;display:flex;align-items:center;justify-content:space-between;gap:16px}.upgrade-strip{background:#f5f8ff;border:1px solid #dbe7ff}.upgrade-strip div{display:flex;flex-direction:column;gap:2px}.upgrade-strip span{color:#475467;font-size:14px}.subscription-warning{background:#fff7ed;border:1px solid #fed7aa}.subscription-warning p{margin:3px 0 0;color:#9a3412;font-size:13px;max-width:720px}.empty-state{background:#fff;border:1px dashed #cbd5e1;border-radius:16px;padding:44px;text-align:center}.empty-state h2{margin-top:0}.history-panel{margin-top:26px;background:#fff;border:1px solid var(--line);border-radius:14px;overflow:hidden}.history-panel summary{cursor:pointer;padding:16px 20px;font-weight:800}.history-panel summary span{display:inline-flex;margin-left:6px;min-width:22px;height:22px;align-items:center;justify-content:center;border-radius:99px;background:#f2f4f7;color:#475467;font-size:12px}.history-list{border-top:1px solid var(--line)}.history-row{display:grid;grid-template-columns:1fr auto auto;align-items:center;gap:18px;padding:14px 20px;border-bottom:1px solid var(--line)}.history-row:last-child{border-bottom:0}.history-row>div:first-child{display:flex;flex-direction:column}.history-row span{font-size:13px;color:var(--muted)}.history-status{font-size:13px;color:var(--muted)}.history-row a{font-weight:700;color:var(--blue);text-decoration:none}.back-link{display:inline-block;margin-bottom:20px;color:#475467;text-decoration:none;font-weight:700}.licence-detail-head{display:flex;align-items:flex-end;justify-content:space-between;gap:20px;margin-bottom:24px}.licence-detail-head h1{font-size:32px}.detail-grid{display:grid;grid-template-columns:minmax(0,1.65fr) minmax(280px,.7fr);gap:18px}.panel{margin:0}.panel h2{margin:0;font-size:20px}.panel-heading{display:flex;justify-content:space-between;gap:18px;align-items:flex-start;padding-bottom:18px;border-bottom:1px solid var(--line)}.panel-heading p{margin:4px 0 0;color:var(--muted)}.activation-count{font-weight:800;background:var(--blue-soft);color:var(--blue-dark);padding:6px 10px;border-radius:999px}.device-row{display:grid;grid-template-columns:42px 1fr auto;gap:14px;align-items:center;padding:17px 0;border-bottom:1px solid var(--line)}.device-row:last-child{border-bottom:0}.device-icon{width:42px;height:42px;display:flex;align-items:center;justify-content:center;background:#f2f4f7;border-radius:10px;font-size:20px}.device-copy{display:flex;flex-direction:column;min-width:0}.device-copy span,.device-copy small{color:var(--muted)}.device-copy small{margin-top:2px}.empty-inline{padding:26px 0 4px;color:var(--muted)}.subscription-panel form+form{margin-top:10px}.subscription-facts{margin:18px 0 22px}.subscription-facts>div{display:flex;justify-content:space-between;gap:16px;padding:11px 0;border-bottom:1px solid var(--line)}.subscription-facts dt{color:var(--muted)}.subscription-facts dd{margin:0;font-weight:700;text-align:right}
+
+        .site-footer{background:#0b1220;color:#94a3b8;border-top:1px solid rgba(255,255,255,.06)}.footer-shell{max-width:1220px;margin:0 auto;padding:34px 24px;display:flex;align-items:center;justify-content:space-between;gap:28px}.footer-brand{display:flex;align-items:center;gap:10px;color:#e2e8f0;font-weight:800}.footer-brand img{width:28px;height:28px;border-radius:7px}.footer-links{display:flex;gap:20px;flex-wrap:wrap}.footer-links a{color:#cbd5e1;text-decoration:none;font-size:13px;font-weight:650}.footer-links a:hover{color:#fff}.footer-cookie-link{background:none!important;border:0!important;padding:0!important;color:#cbd5e1!important;font-size:13px!important;font-weight:650!important;box-shadow:none!important}.footer-cookie-link:hover{color:#fff!important}.footer-copy{font-size:12px;margin-top:5px}
+
+        @media(max-width:980px){
+            .hero-grid{grid-template-columns:1fr;gap:48px}.app-window{max-width:720px;transform:none}.feature-grid{grid-template-columns:repeat(2,minmax(0,1fr))}.workflow-grid{grid-template-columns:repeat(2,1fr)}.security-panel{grid-template-columns:1fr;gap:28px}.nav-email{display:none}
+        }
+        @media(max-width:760px){
+            .site-header{position:relative}.nav-shell{padding:10px 16px;min-height:64px;gap:12px;flex-wrap:wrap}.brand{margin-right:auto}.nav-links{order:3;width:100%;gap:18px;overflow-x:auto;padding:2px 0 4px}.nav-links::-webkit-scrollbar{display:none}.nav-account{margin-left:0}.nav-account .nav-auth-link{display:none}.wrap{padding:28px 16px 48px}.pricing-grid,.plan-grid{grid-template-columns:1fr}.hero-card h1,.portal-header h1{font-size:32px}.portal-header,.licence-detail-head,.licence-title-row,.upgrade-strip,.subscription-warning{align-items:stretch;flex-direction:column}.portal-header .btn,.licence-title-row .btn{width:100%}.licence-stats{grid-template-columns:1fr}.detail-grid{grid-template-columns:1fr}.history-row{grid-template-columns:1fr auto}.history-row a{grid-column:1/-1}.device-row{grid-template-columns:38px 1fr}.device-row form{grid-column:1/-1}.device-row form button{width:100%}
+            .launch-hero{padding:58px 18px 88px;background:linear-gradient(180deg,#0b1220 0,#101b31 84%,#f7f9fc 84%)}.launch-hero h1{font-size:48px}.hero-copy{font-size:17px}.app-body{grid-template-columns:120px 1fr;min-height:330px}.app-sidebar{padding:12px 8px}.side-item{padding:7px 8px}.app-content{padding:14px}.launch-section{padding:68px 18px}.feature-grid,.workflow-grid{grid-template-columns:1fr}.security-panel{padding:30px 24px;border-radius:20px}.security-panel h2{font-size:32px}.cta-box{padding:36px 26px;align-items:flex-start;flex-direction:column}.cta-box h2{font-size:32px}.footer-shell{align-items:flex-start;flex-direction:column}.launch-cta{padding:16px 18px 72px}
+        }
+        @media(max-width:480px){.launch-hero h1{font-size:42px}.hero-actions{flex-direction:column}.hero-actions .btn{width:100%}.app-body{grid-template-columns:1fr}.app-sidebar{display:none}.window-title{display:none}.launch-kicker{font-size:11px}.feature-card{padding:22px}}
+        @media(prefers-reduced-motion:reduce){html{scroll-behavior:auto}*{transition:none!important}}
+
+
+        /* Launch polish + GDPR/support UI */
+        .launch-hero{background:linear-gradient(135deg,#07111f 0%,#0b1d36 54%,#0c2b55 100%);padding:78px 24px 82px}
+        .launch-hero:after{content:"";position:absolute;right:-10%;bottom:-36%;width:58%;height:80%;background:radial-gradient(ellipse at center,rgba(37,99,235,.45),rgba(14,165,233,.14) 42%,transparent 68%);filter:blur(18px);pointer-events:none}
+        .app-window{background:#1c1c1e;border-color:rgba(255,255,255,.14);box-shadow:0 34px 70px rgba(0,0,0,.42)}
+        .window-bar{background:#252527;border-bottom-color:#353539;color:#d4d4d8}.app-body{background:#1c1c1e}.app-sidebar{background:#252526;border-right:1px solid #39393d}.mini-brand{color:#f4f4f5}.side-item{color:#b7b7bd}.side-item.active{background:#1677ea;color:white}.app-content{background:#1c1c1e;color:#f4f4f5}.mock-job{background:#242426;border-color:#37373b;box-shadow:none}.mock-job p,.app-statusbar{color:#9f9fa6}.app-toolbar{color:#f4f4f5}.mock-progress{background:#34343a}
+        .launch-section{position:relative}.feature-card{border:1px solid rgba(148,163,184,.18);box-shadow:0 14px 34px rgba(15,23,42,.06);transition:transform .18s ease,box-shadow .18s ease}.feature-card:hover{transform:translateY(-3px);box-shadow:0 20px 42px rgba(15,23,42,.10)}
+        .feature-card:nth-child(1){background:linear-gradient(135deg,#eef7ff,#dceeff)}.feature-card:nth-child(2){background:linear-gradient(135deg,#effdf5,#d9f8e7)}.feature-card:nth-child(3){background:linear-gradient(135deg,#fff9ed,#ffedc9)}.feature-card:nth-child(4){background:linear-gradient(135deg,#f8f1ff,#eadcff)}.feature-card:nth-child(5){background:linear-gradient(135deg,#fff1f4,#ffdce4)}.feature-card:nth-child(6){background:linear-gradient(135deg,#eafffb,#ccf7ef)}
+        .feature-card:nth-child(1) .feature-icon{background:#d7ebff;color:#1474e5}.feature-card:nth-child(2) .feature-icon{background:#c9f3dc;color:#079455}.feature-card:nth-child(3) .feature-icon{background:#ffe2aa;color:#e87500}.feature-card:nth-child(4) .feature-icon{background:#dfc9ff;color:#7c3aed}.feature-card:nth-child(5) .feature-icon{background:#ffc8d4;color:#e11d48}.feature-card:nth-child(6) .feature-icon{background:#bff2e9;color:#0891b2}
+        input,select,textarea{width:100%;padding:11px 12px;border:1px solid #cbd5e1;border-radius:9px;margin:6px 0 14px;background:#fff;color:var(--text);font:inherit}textarea{resize:vertical;min-height:150px}select{appearance:auto}.field-error{color:var(--red);font-size:13px;margin:-8px 0 12px}.form-help{font-size:12px;color:var(--muted);margin:-8px 0 14px}.honeypot{position:absolute!important;left:-10000px!important;width:1px!important;height:1px!important;overflow:hidden!important}
+        .support-hero{padding:8px 0 28px}.support-hero h1{font-size:44px;line-height:1.05;letter-spacing:-.04em;margin:8px 0 12px}.support-layout{display:grid;grid-template-columns:minmax(0,1.5fr) minmax(280px,.7fr);gap:22px;align-items:start}.support-form-card{background:#fff;border:1px solid var(--line);border-radius:20px;padding:28px;box-shadow:var(--shadow-md)}.panel-heading-simple{display:flex;align-items:flex-start;justify-content:space-between;gap:20px;padding-bottom:20px;border-bottom:1px solid var(--line);margin-bottom:22px}.panel-heading-simple h2{margin:0 0 4px;font-size:23px}.panel-heading-simple p{margin:0;color:var(--muted)}.response-badge{background:var(--blue-soft);color:var(--blue-dark);padding:6px 10px;border-radius:999px;font-size:12px;font-weight:800}.form-grid.two{display:grid;grid-template-columns:1fr 1fr;gap:16px}.consent-check{display:flex;align-items:flex-start;gap:10px;font-weight:500;color:#475467;margin:2px 0 20px}.consent-check input{width:18px;height:18px;margin:2px 0 0;flex:0 0 auto}.consent-check a{color:var(--blue);font-weight:700}.support-actions{display:flex;gap:12px;flex-wrap:wrap}.support-side{display:grid;gap:14px}.support-info-card{padding:22px;border-radius:18px;border:1px solid rgba(15,23,42,.08);box-shadow:var(--shadow-sm)}.support-info-card.blue{background:linear-gradient(135deg,#eff6ff,#dbeafe)}.support-info-card.green{background:linear-gradient(135deg,#ecfdf3,#d1fadf)}.support-info-card.violet{background:linear-gradient(135deg,#f5f3ff,#ede9fe)}.support-info-card h3{margin:12px 0 6px}.support-info-card p{margin:0;color:#475467}.support-info-icon{width:40px;height:40px;border-radius:11px;background:rgba(255,255,255,.75);display:flex;align-items:center;justify-content:center;font-size:20px;font-weight:900;color:var(--blue)}
+        .legal-page{max-width:840px;margin:0 auto;background:#fff;border:1px solid var(--line);border-radius:20px;padding:42px 46px;box-shadow:var(--shadow-sm)}.legal-head{padding-bottom:24px;border-bottom:1px solid var(--line);margin-bottom:26px}.legal-head h1{font-size:42px;line-height:1.05;letter-spacing:-.04em;margin:8px 0}.legal-head p{margin:0;color:var(--muted)}.legal-intro{font-size:18px;line-height:1.65;color:#344054;background:linear-gradient(135deg,#eff6ff,#f8fafc);border:1px solid #dbeafe;border-radius:14px;padding:18px 20px;margin-bottom:30px}.legal-page section{padding:4px 0 16px}.legal-page h2{font-size:21px;margin:16px 0 8px}.legal-page p{color:#475467;line-height:1.72}.legal-page a,.link-button{color:var(--blue);font-weight:700}.link-button{padding:0;background:none;border:0;box-shadow:none;text-decoration:underline;display:inline}.link-button:hover{background:none;color:var(--blue-dark)}.legal-table,.cookie-table{display:grid;gap:10px}.legal-table>div,.cookie-table>div{display:grid;grid-template-columns:150px 1fr;gap:18px;padding:14px 0;border-bottom:1px solid var(--line)}.legal-table span,.cookie-table span{color:#475467}
+        .cookie-banner{position:fixed;z-index:1000;left:20px;right:20px;bottom:20px;max-width:980px;margin:auto;background:rgba(12,20,36,.98);color:#fff;border:1px solid rgba(255,255,255,.14);border-radius:18px;padding:20px 22px;box-shadow:0 24px 80px rgba(0,0,0,.38);backdrop-filter:blur(18px);display:none}.cookie-banner.is-open{display:block}.cookie-banner-grid{display:grid;grid-template-columns:1fr auto;gap:24px;align-items:center}.cookie-banner h2{margin:0 0 5px;font-size:18px}.cookie-banner p{margin:0;color:#cbd5e1;font-size:13px;line-height:1.55}.cookie-banner a{color:#bfdbfe}.cookie-actions{display:flex;gap:8px;flex-wrap:wrap;justify-content:flex-end}.cookie-actions button{padding:9px 12px}.cookie-actions .btn-secondary{background:transparent;color:#fff;border-color:rgba(255,255,255,.25)}
+        .cookie-modal-backdrop{position:fixed;z-index:1100;inset:0;background:rgba(2,6,23,.64);display:none;align-items:center;justify-content:center;padding:20px}.cookie-modal-backdrop.is-open{display:flex}.cookie-modal{width:min(620px,100%);max-height:90vh;overflow:auto;background:#fff;border-radius:20px;box-shadow:0 34px 90px rgba(0,0,0,.35)}.cookie-modal-head{padding:24px 26px 18px;border-bottom:1px solid var(--line);display:flex;justify-content:space-between;gap:18px}.cookie-modal-head h2{margin:0;font-size:24px}.cookie-close{background:#f2f4f7;color:#344054;width:36px;height:36px;padding:0;border-radius:50%}.cookie-close:hover{background:#e4e7ec}.cookie-modal-body{padding:8px 26px 4px}.cookie-option{display:grid;grid-template-columns:1fr auto;gap:18px;padding:17px 0;border-bottom:1px solid var(--line)}.cookie-option h3{margin:0 0 4px;font-size:16px}.cookie-option p{margin:0;color:var(--muted);font-size:13px}.cookie-switch{width:46px!important;height:24px!important;margin:2px 0!important;accent-color:var(--blue)}.cookie-modal-actions{padding:20px 26px 24px;display:flex;gap:10px;justify-content:flex-end;flex-wrap:wrap}.cookie-required{font-size:12px;font-weight:800;color:var(--green);padding-top:4px}
+        .admin-ticket-list{display:grid;gap:10px}.admin-ticket-row{display:grid;grid-template-columns:minmax(0,1fr) auto auto auto;gap:18px;align-items:center;padding:16px 18px;background:#fff;border:1px solid var(--line);border-radius:14px;text-decoration:none;box-shadow:var(--shadow-sm)}.admin-ticket-row:hover{border-color:#b8cdf6}.admin-ticket-row>div:first-child{display:flex;flex-direction:column;min-width:0}.admin-ticket-row small{color:var(--muted)}.ticket-ref{font-size:11px;letter-spacing:.06em;text-transform:uppercase;color:var(--blue);font-weight:850}.ticket-category,.ticket-status{padding:5px 8px;border-radius:999px;font-size:12px;font-weight:800;background:#f2f4f7;color:#475467}.status-new{background:#eff6ff;color:#1d4ed8}.status-open{background:#ecfdf3;color:#067647}.status-waiting{background:#fff7ed;color:#9a3412}.status-resolved,.status-closed{background:#f2f4f7;color:#475467}.admin-ticket-row time{color:var(--muted);font-size:12px}.filter-bar{display:flex;align-items:center;gap:10px;margin-bottom:18px}.filter-bar select{width:auto;margin:0}.ticket-detail-head{display:flex;justify-content:space-between;align-items:flex-start;gap:20px;margin-bottom:22px}.ticket-detail-head h1{font-size:34px;line-height:1.12;letter-spacing:-.03em;margin:6px 0}.ticket-detail-head p{margin:0;color:var(--muted)}.ticket-message .ticket-meta{display:flex;gap:12px;color:var(--muted);font-size:13px;margin:8px 0 20px}.message-body{white-space:normal;background:#f8fafc;border:1px solid var(--line);border-radius:12px;padding:18px;line-height:1.7;margin-bottom:18px}
+        @media(max-width:800px){.support-layout{grid-template-columns:1fr}.form-grid.two{grid-template-columns:1fr}.legal-page{padding:28px 22px}.legal-table>div,.cookie-table>div{grid-template-columns:1fr;gap:4px}.cookie-banner-grid{grid-template-columns:1fr}.cookie-actions{justify-content:flex-start}.admin-ticket-row{grid-template-columns:1fr auto}.admin-ticket-row .ticket-category,.admin-ticket-row time{display:none}.ticket-detail-head{flex-direction:column}}
+
+    </style>
+    @stack('head')
+</head>
+<body>
+<header class="site-header">
+    <nav class="nav-shell" aria-label="Primary navigation">
+        <a class="brand" href="{{ route('home') }}">
+            <img src="{{ asset('icons/rsync-studio-icon-64.png') }}" alt="" width="34" height="34">
+            <span>Rsync Studio</span>
+        </a>
+        <div class="nav-links">
+            <a href="{{ route('home') }}">Product</a>
+            <a href="{{ route('buy') }}">Pricing</a>
+            <a href="{{ route('support') }}">Support</a>
+            <a href="{{ route('privacy') }}">Privacy</a>
+            @auth
+                @if (auth()->user()->hasVerifiedEmail())
+                    <a href="{{ route('portal.index') }}">My licences</a>
+                @endif
+
+                @if (auth()->user()->is_admin)
+                    @php
+                        $supportUnread = auth()->user()
+                            ->unreadNotifications()
+                            ->where('type', \App\Notifications\NewSupportTicket::class)
+                            ->count();
+                    @endphp
+
+                    <a href="{{ route('admin.index') }}">Admin</a>
+                    <a href="{{ route('admin.support.index') }}">
+                        Support
+                        @if ($supportUnread > 0)
+                            <span class="nav-alert-count">{{ $supportUnread }}</span>
+                        @endif
+                    </a>
+                @endif
+            @endauth
+        </div>
+        <div class="nav-account">
+            @auth
+                <span class="nav-email">{{ auth()->user()->email }}</span>
+                <form method="post" action="{{ route('logout') }}">@csrf<button type="submit" class="nav-signout">Sign out</button></form>
+            @else
+                <a class="nav-auth-link" href="{{ route('login') }}">Sign in</a>
+                <a class="nav-cta" href="{{ route('buy') }}">Start free trial</a>
+            @endauth
+        </div>
+    </nav>
+</header>
+
+@hasSection('fullbleed')
+    @yield('fullbleed')
+@else
+    <main class="wrap">
+        @if(session('status'))<div class="alert">{{ session('status') }}</div>@endif
+        @if($errors->any())<div class="error">{{ $errors->first() }}</div>@endif
+        @yield('content')
+    </main>
+@endif
+
+<footer class="site-footer">
+    <div class="footer-shell">
+        <div>
+            <div class="footer-brand"><img src="{{ asset('icons/rsync-studio-icon-64.png') }}" alt="" width="28" height="28"><span>Rsync Studio</span></div>
+            <div class="footer-copy">Native rsync job management for macOS.</div>
+        </div>
+        <div class="footer-links">
+            <a href="{{ route('home') }}">Product</a>
+            <a href="{{ route('buy') }}">Pricing</a>
+            <a href="{{ route('support') }}">Support</a>
+            <a href="{{ route('privacy') }}">Privacy</a>
+            <a href="{{ route('terms') }}">Terms</a>
+            <a href="{{ route('cookies') }}">Cookies</a>
+            <button type="button" class="footer-cookie-link" data-cookie-settings>Cookie settings</button>
+            @auth @if(auth()->user()->hasVerifiedEmail())<a href="{{ route('portal.index') }}">Licence portal</a>@endif @else<a href="{{ route('login') }}">Sign in</a>@endauth
+        </div>
+    </div>
+</footer>
+
+
+<div class="cookie-banner" id="cookieBanner" role="region" aria-label="Cookie consent">
+    <div class="cookie-banner-grid">
+        <div>
+            <h2>Your privacy choices</h2>
+            <p>We use necessary cookies for security, sign-in and licence services. Optional cookies stay off unless you choose them. Read our <a href="{{ route('cookies') }}">Cookie Policy</a>.</p>
+        </div>
+        <div class="cookie-actions">
+            <button type="button" class="btn btn-secondary" id="cookieReject">Reject non-essential</button>
+            <button type="button" class="btn btn-secondary" data-cookie-settings>Cookie settings</button>
+            <button type="button" class="btn btn-primary" id="cookieAccept">Accept all</button>
+        </div>
+    </div>
+</div>
+
+<div class="cookie-modal-backdrop" id="cookieModal" role="presentation">
+    <section class="cookie-modal" role="dialog" aria-modal="true" aria-labelledby="cookieModalTitle">
+        <div class="cookie-modal-head"><div><span class="eyebrow">Privacy controls</span><h2 id="cookieModalTitle">Cookie settings</h2></div><button type="button" class="cookie-close" id="cookieClose" aria-label="Close cookie settings">×</button></div>
+        <div class="cookie-modal-body">
+            <div class="cookie-option"><div><h3>Necessary</h3><p>Required for security, authentication, sessions and remembering this choice.</p></div><span class="cookie-required">Always on</span></div>
+            <label class="cookie-option"><div><h3>Preferences</h3><p>Allows non-essential interface preferences to be remembered.</p></div><input class="cookie-switch" type="checkbox" id="cookiePreferences"></label>
+            <label class="cookie-option"><div><h3>Analytics</h3><p>Helps understand site usage. No analytics is loaded unless this is enabled.</p></div><input class="cookie-switch" type="checkbox" id="cookieAnalytics"></label>
+            <label class="cookie-option"><div><h3>Marketing</h3><p>Allows optional marketing technologies. None is loaded unless this is enabled.</p></div><input class="cookie-switch" type="checkbox" id="cookieMarketing"></label>
+        </div>
+        <div class="cookie-modal-actions"><button type="button" class="btn btn-secondary" id="cookieRejectModal">Reject non-essential</button><button type="button" class="btn btn-primary" id="cookieSave">Save choices</button></div>
+    </section>
+</div>
+
+<script>
+(() => {
+    const COOKIE_NAME = 'rsync_cookie_consent_v{{ config('rsync-studio.privacy.cookie_version', '1') }}';
+    const banner = document.getElementById('cookieBanner');
+    const modal = document.getElementById('cookieModal');
+    const prefs = document.getElementById('cookiePreferences');
+    const analytics = document.getElementById('cookieAnalytics');
+    const marketing = document.getElementById('cookieMarketing');
+
+    const read = () => {
+        const match = document.cookie.split('; ').find(row => row.startsWith(COOKIE_NAME + '='));
+        if (!match) return null;
+        try { return JSON.parse(decodeURIComponent(match.substring(COOKIE_NAME.length + 1))); } catch (_) { return null; }
+    };
+    const write = (value) => {
+        const secure = location.protocol === 'https:' ? '; Secure' : '';
+        document.cookie = COOKIE_NAME + '=' + encodeURIComponent(JSON.stringify(value)) + '; Max-Age=31536000; Path=/; SameSite=Lax' + secure;
+        window.rsyncCookieConsent = value;
+        window.dispatchEvent(new CustomEvent('rsync:cookie-consent', {detail:value}));
+        banner.classList.remove('is-open'); modal.classList.remove('is-open'); document.body.style.overflow = '';
+    };
+    const reject = () => write({necessary:true,preferences:false,analytics:false,marketing:false,updatedAt:new Date().toISOString()});
+    const open = () => { const current = read() || {}; prefs.checked=!!current.preferences; analytics.checked=!!current.analytics; marketing.checked=!!current.marketing; modal.classList.add('is-open'); document.body.style.overflow='hidden'; };
+    const close = () => { modal.classList.remove('is-open'); document.body.style.overflow=''; };
+
+    document.querySelectorAll('[data-cookie-settings]').forEach(el => el.addEventListener('click', open));
+    document.getElementById('cookieAccept').addEventListener('click', () => write({necessary:true,preferences:true,analytics:true,marketing:true,updatedAt:new Date().toISOString()}));
+    document.getElementById('cookieReject').addEventListener('click', reject);
+    document.getElementById('cookieRejectModal').addEventListener('click', reject);
+    document.getElementById('cookieSave').addEventListener('click', () => write({necessary:true,preferences:prefs.checked,analytics:analytics.checked,marketing:marketing.checked,updatedAt:new Date().toISOString()}));
+    document.getElementById('cookieClose').addEventListener('click', close);
+    modal.addEventListener('click', e => { if (e.target === modal) close(); });
+    document.addEventListener('keydown', e => { if (e.key === 'Escape' && modal.classList.contains('is-open')) close(); });
+
+    const current = read();
+    window.rsyncCookieConsent = current || {necessary:true,preferences:false,analytics:false,marketing:false};
+    if (!current) banner.classList.add('is-open');
+})();
+</script>
+
+</body>
+</html>

rsync-studio-licensing/resources/views/legal/cookies.blade.php

@@ -0,0 +1,16 @@
+@extends('layouts.app', ['title' => 'Cookie Policy — Rsync Studio'])
+
+@section('content')
+<article class="legal-page">
+    <header class="legal-head"><span class="eyebrow">Privacy controls</span><h1>Cookie Policy</h1><p>Last updated 9 September 2026</p></header>
+    <div class="legal-intro">Rsync Studio uses a small number of cookies or equivalent browser storage items. Optional categories are off by default until you consent.</div>
+
+    <section><h2>Necessary</h2><p>These are required for security and core site features and cannot be disabled through Cookie Settings.</p><div class="cookie-table"><div><strong>Session cookie</strong><span>Keeps you signed in and maintains the secure server session. Session or configured server lifetime.</span></div><div><strong>XSRF / CSRF protection</strong><span>Helps protect forms and authenticated actions against cross-site request forgery. Session or configured framework lifetime.</span></div><div><strong>Cookie consent preference</strong><span>Stores the categories you selected so we do not ask on every page. Up to 12 months.</span></div></div></section>
+
+    <section><h2>Preferences</h2><p>Preference storage is optional and disabled unless you enable it. It may be used for non-essential interface choices in future versions of the site.</p></section>
+    <section><h2>Analytics</h2><p>Analytics is currently disabled by default. If analytics tooling is added, it must only load after you enable Analytics in Cookie Settings and this policy must be updated to identify the provider and retention period.</p></section>
+    <section><h2>Marketing</h2><p>Marketing storage is currently disabled by default. Marketing or advertising technology must not load before you expressly enable this category.</p></section>
+    <section><h2>Paddle checkout</h2><p>When you choose to start checkout, Paddle's checkout is loaded to provide payment and subscription functionality. Paddle may use storage that is necessary to provide checkout, prevent fraud and comply with payment obligations. Paddle provides its own privacy and cookie information for its service.</p></section>
+    <section><h2>Change your choice</h2><p>You can revisit your choice at any time.</p><button type="button" class="btn btn-secondary" data-cookie-settings>Open Cookie Settings</button></section>
+</article>
+@endsection

rsync-studio-licensing/resources/views/legal/privacy.blade.php

@@ -0,0 +1,39 @@
+@extends('layouts.app', ['title' => 'Privacy Policy — Rsync Studio'])
+
+@section('content')
+@php
+    $legal = config('rsync-studio.legal');
+    $retention = config('rsync-studio.privacy.support_retention_days', 730);
+@endphp
+<article class="legal-page">
+    <header class="legal-head">
+        <span class="eyebrow">Privacy</span>
+        <h1>Privacy Policy</h1>
+        <p>Last updated 9 September 2026 · Policy version {{ config('rsync-studio.privacy.policy_version') }}</p>
+    </header>
+
+    <div class="legal-intro">{{ $legal['controller_name'] }} is the data controller for personal data processed through the Rsync Studio website, licence portal and support service. We process only the information needed to sell, license, secure and support Rsync Studio.</div>
+
+    <section><h2>Information we process</h2><p>We may process your name, email address, account credentials in hashed form, licence and activation identifiers, subscription and billing status, support requests, and technical server logs required to operate and secure the service. Rsync Studio does not send the files you sync, SSH passwords or private SSH keys to the licensing service.</p></section>
+
+    <section><h2>Payments</h2><p>Payments and subscription checkout are handled by Paddle. Payment-card details are entered into Paddle's checkout and are not stored by Rsync Studio. We receive identifiers and subscription information needed to provision and manage your licence. Paddle acts independently for parts of its payment and tax processing and provides its own privacy information.</p></section>
+
+    <section><h2>Why we use your information</h2><div class="legal-table"><div><strong>Contract</strong><span>Creating your account, providing licences, validating activations, managing subscriptions and delivering support you request.</span></div><div><strong>Legitimate interests</strong><span>Securing the service, preventing abuse, troubleshooting faults and maintaining reliable operational records where those interests do not override your rights.</span></div><div><strong>Legal obligations</strong><span>Records we must keep for accounting, tax, fraud prevention or other applicable legal requirements.</span></div><div><strong>Consent</strong><span>Any optional analytics or marketing storage, if introduced, is disabled until you choose to enable it through Cookie Settings.</span></div></div></section>
+
+    <section><h2>Support requests</h2><p>Support requests are stored in our database and emailed to the configured support team. We retain resolved support tickets for up to {{ $retention }} days, unless a longer period is necessary for an unresolved dispute, security matter or legal obligation. A scheduled retention process removes eligible resolved tickets.</p></section>
+
+    <section><h2>Licence and account records</h2><p>Licence, activation and subscription records are kept while your subscription or licence relationship is active and for a reasonable period afterwards where required for licence recovery, fraud prevention, accounting, dispute handling and legal obligations. We minimise retained data and do not use licence validation to inspect your synced files.</p></section>
+
+    <section><h2>Who receives data</h2><p>Information may be processed by service providers that are necessary to run Rsync Studio, such as Paddle for checkout and subscription processing, our hosting/infrastructure providers, and email delivery infrastructure. We limit disclosure to what is necessary for the relevant service and require appropriate safeguards where applicable.</p></section>
+
+    <section><h2>International transfers</h2><p>Some service providers may process information outside the UK or EEA. Where data-protection law requires it, appropriate transfer mechanisms and safeguards must be used by the relevant controller or processor.</p></section>
+
+    <section><h2>Cookies and local storage</h2><p>Necessary cookies are used for security, authentication, sessions and your privacy preferences. Optional analytics and marketing categories default to off and must not be loaded before consent. See our <a href="{{ route('cookies') }}">Cookie Policy</a> or use <button type="button" class="link-button" data-cookie-settings>Cookie Settings</button>.</p></section>
+
+    <section><h2>Your rights</h2><p>Depending on the circumstances, you may have rights to access, correct, erase, restrict or object to processing of your personal data, request portability, and withdraw consent at any time where processing relies on consent. You also have the right to complain to the UK Information Commissioner's Office or your applicable supervisory authority.</p><p>Use the <a href="{{ route('support') }}">support form</a> and choose “Privacy / data request”. We may need to verify your identity before acting on a request.</p></section>
+
+    <section><h2>Security</h2><p>We use access controls, TLS, password hashing, CSRF protection, rate limiting and restricted administrative access. No internet service can guarantee absolute security, so we also minimise the personal data we collect.</p></section>
+
+    <section><h2>Contact</h2><p>Controller: <strong>{{ $legal['controller_name'] }}</strong><br>Country: {{ $legal['country'] }}<br>Privacy contact: <a href="mailto:{{ $legal['privacy_email'] }}">{{ $legal['privacy_email'] }}</a></p></section>
+</article>
+@endsection