Initial Commit

2026-09-29 11:12:07 +01:00
commit 89bbdbfcba
133 changed files with 15743 additions and 0 deletions
@@ -0,0 +1,18 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+indent_size = 4
+indent_style = space
+insert_final_newline = true
+trim_trailing_whitespace = true
+
+[*.md]
+trim_trailing_whitespace = false
+
+[*.{yml,yaml}]
+indent_size = 2
+
+[{compose,docker-compose}.{yml,yaml}]
+indent_size = 4
@@ -0,0 +1,87 @@
+APP_NAME=Laravel
+APP_ENV=local
+APP_KEY=
+APP_DEBUG=true
+APP_URL=http://localhost:8000
+
+APP_LOCALE=en
+APP_FALLBACK_LOCALE=en
+APP_FAKER_LOCALE=en_US
+
+APP_MAINTENANCE_DRIVER=file
+# APP_MAINTENANCE_STORE=database
+
+# PHP_CLI_SERVER_WORKERS=4
+
+BCRYPT_ROUNDS=12
+
+LOG_CHANNEL=stack
+LOG_STACK=single
+LOG_DEPRECATIONS_CHANNEL=null
+LOG_LEVEL=debug
+
+DB_CONNECTION=sqlite
+# DB_HOST=127.0.0.1
+# DB_PORT=3306
+# DB_DATABASE=laravel
+# DB_USERNAME=root
+# DB_PASSWORD=
+
+SESSION_DRIVER=database
+SESSION_LIFETIME=120
+SESSION_ENCRYPT=false
+SESSION_PATH=/
+SESSION_DOMAIN=null
+
+BROADCAST_CONNECTION=log
+FILESYSTEM_DISK=local
+QUEUE_CONNECTION=database
+
+CACHE_STORE=database
+# CACHE_PREFIX=
+
+MEMCACHED_HOST=127.0.0.1
+
+REDIS_CLIENT=phpredis
+REDIS_HOST=127.0.0.1
+REDIS_PASSWORD=null
+REDIS_PORT=6379
+
+MAIL_MAILER=log
+MAIL_SCHEME=null
+MAIL_HOST=127.0.0.1
+MAIL_PORT=2525
+MAIL_USERNAME=null
+MAIL_PASSWORD=null
+MAIL_FROM_ADDRESS="hello@example.com"
+MAIL_FROM_NAME="${APP_NAME}"
+
+AWS_ACCESS_KEY_ID=
+AWS_SECRET_ACCESS_KEY=
+AWS_DEFAULT_REGION=us-east-1
+AWS_BUCKET=
+AWS_USE_PATH_STYLE_ENDPOINT=false
+
+VITE_APP_NAME="${APP_NAME}"
+
+# SonarDesk commercial/licensing
+SONARDESK_LICENSE_PRIVATE_KEY_PATH=
+SONARDESK_LICENSE_PUBLIC_KEY=
+SONARDESK_DEFAULT_EDITION=Professional
+SONARDESK_DEFAULT_MAX_MAJOR_VERSION=1
+SONARDESK_PURCHASE_URL=
+SONARDESK_PORTAL_URL=
+SONARDESK_SUPPORT_URL=
+PADDLE_API_KEY=
+PADDLE_API_URL=https://sandbox-api.paddle.com
+PADDLE_CLIENT_SIDE_TOKEN=
+PADDLE_ENVIRONMENT=sandbox
+PADDLE_WEBHOOK_SECRET=
+PADDLE_WEBHOOK_TOLERANCE=300
+PADDLE_PERSONAL_PRODUCT_ID=
+PADDLE_PERSONAL_MONTHLY_PRICE_ID=
+PADDLE_PERSONAL_ANNUAL_PRICE_ID=
+PADDLE_PROFESSIONAL_PRODUCT_ID=
+PADDLE_PROFESSIONAL_MONTHLY_PRICE_ID=
+PADDLE_PROFESSIONAL_ANNUAL_PRICE_ID=
+LEMON_SQUEEZY_WEBHOOK_SECRET=
@@ -0,0 +1,11 @@
+* text=auto eol=lf
+
+*.blade.php diff=html
+*.css diff=css
+*.html diff=html
+*.md diff=markdown
+*.php diff=php
+
+/.github export-ignore
+CHANGELOG.md export-ignore
+.styleci.yml export-ignore
@@ -0,0 +1,27 @@
+*.log
+.DS_Store
+.env
+.env.backup
+.env.production
+.phpactor.json
+.phpunit.result.cache
+/.codex
+/.cursor/
+/.idea
+/.nova
+/.phpunit.cache
+/.vscode
+/.zed
+/auth.json
+/node_modules
+/public/build
+/public/fonts-manifest.dev.json
+/public/hot
+/public/storage
+/storage/*.key
+/storage/pail
+/vendor
+_ide_helper.php
+Homestead.json
+Homestead.yaml
+Thumbs.db
@@ -0,0 +1,2 @@
+ignore-scripts=true
+audit=true
@@ -0,0 +1,47 @@
+<laravel-boost-guidelines>
+# Laravel Application
+
+This repository contains a Laravel application. Complete the following setup before working on the user's request.
+
+## Prerequisites
+
+Verify that PHP and Composer are available:
+
+```sh
+php -v
+composer -V
+```
+
+If either command is unavailable, detect the user's operating system and install the prerequisites with the appropriate command:
+
+macOS:
+
+```sh
+/bin/bash -c "$(curl -fsSL https://php.new/install/mac/8.5)"
+```
+
+Windows PowerShell:
+
+```powershell
+Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://php.new/install/windows/8.5'))
+```
+
+Linux:
+
+```sh
+/bin/bash -c "$(curl -fsSL https://php.new/install/linux/8.5)"
+```
+
+After installation, ask the user to restart their terminal. If the agent needs the restarted shell to continue, ask the user to reopen their terminal and rerun their original prompt.
+
+## Agent Setup
+
+Install Laravel Boost from the application root before making application changes:
+
+```sh
+composer require laravel/boost --dev
+php artisan boost:install
+```
+
+Boost replaces these bootstrap instructions with guidelines tailored to the application. After installation, read `AGENTS.md` again and continue with the user's original request using the generated guidelines.
+</laravel-boost-guidelines>
@@ -0,0 +1,47 @@
+<laravel-boost-guidelines>
+# Laravel Application
+
+This repository contains a Laravel application. Complete the following setup before working on the user's request.
+
+## Prerequisites
+
+Verify that PHP and Composer are available:
+
+```sh
+php -v
+composer -V
+```
+
+If either command is unavailable, detect the user's operating system and install the prerequisites with the appropriate command:
+
+macOS:
+
+```sh
+/bin/bash -c "$(curl -fsSL https://php.new/install/mac/8.5)"
+```
+
+Windows PowerShell:
+
+```powershell
+Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://php.new/install/windows/8.5'))
+```
+
+Linux:
+
+```sh
+/bin/bash -c "$(curl -fsSL https://php.new/install/linux/8.5)"
+```
+
+After installation, ask the user to restart their terminal. If the agent needs the restarted shell to continue, ask the user to reopen their terminal and rerun their original prompt.
+
+## Agent Setup
+
+Install Laravel Boost from the application root before making application changes:
+
+```sh
+composer require laravel/boost --dev
+php artisan boost:install
+```
+
+Boost replaces these bootstrap instructions with guidelines tailored to the application. After installation, read `AGENTS.md` again and continue with the user's original request using the generated guidelines.
+</laravel-boost-guidelines>
@@ -0,0 +1,17 @@
+# SonarDesk Licensing & CMS Server
+
+Production Laravel backend for SonarDesk.
+
+## Included
+
+- SonarDesk licence products, signed licence issuance, activation and revocation
+- Customer portal with licence and activation management
+- Paddle checkout/webhook provisioning and Lemon Squeezy webhook support
+- Support ticket system and admin inbox
+- Admin dashboard
+- Lightweight CMS for published website pages (`/admin/cms`)
+- SonarDesk-branded public website, legal pages, icons and metadata
+
+## Setup
+
+Copy `.env.example` to `.env`, configure the database, mail, payment provider and SonarDesk signing keys, then run migrations. Keep the private signing key outside the public web root and out of source control.
@@ -0,0 +1,36 @@
+<?php
+
+namespace App\Console\Commands;
+
+use App\Models\User;
+use Illuminate\Console\Command;
+use Illuminate\Support\Facades\Hash;
+use Illuminate\Support\Str;
+
+final class SonarDeskAdminCreate extends Command
+{
+    protected $signature = 'sonardesk:admin {email} {--name=Administrator}';
+
+    protected $description = 'Create or promote an SonarDesk licensing administrator';
+
+    public function handle(): int
+    {
+        $email = strtolower(trim($this->argument('email')));
+        $password = Str::password(24, true, true, false, false);
+        $u = User::firstOrNew(['email' => $email]);
+        $u->name = $this->option('name');
+        $u->is_admin = true;
+        $u->email_verified_at = now();
+        if (! $u->exists) {
+            $u->password = Hash::make($password);
+        } $u->save();
+        $this->info("Administrator ready: {$email}");
+        if (! $u->wasRecentlyCreated) {
+            $this->line('Existing password retained.');
+        } else {
+            $this->warn("Temporary password (shown once): {$password}");
+        }
+
+return self::SUCCESS;
+    }
+}
@@ -0,0 +1,29 @@
+<?php
+
+namespace App\Console\Commands;
+
+use App\Models\LicenseProduct;
+use App\Services\Licensing\LicenseIssuer;
+use Illuminate\Console\Command;
+
+class SonarDeskLicenseIssue extends Command
+{
+    protected $signature = 'sonardesk:license:issue {product} {--name=} {--email=}';
+
+    protected $description = 'Issue a manual SonarDesk licence key';
+
+    public function handle(LicenseIssuer $issuer): int
+    {
+        $p = LicenseProduct::where('code', $this->argument('product'))->firstOrFail();
+        [$l,$key] = $issuer->issue($p, $this->option('name') ?: null, $this->option('email') ?: null);
+        if (! $key) {
+            $this->warn('Licence already existed; plaintext key is intentionally not recoverable.');
+
+            return self::FAILURE;
+        } $this->line('Licence ID: '.$l->id);
+        $this->line('Licence key: '.$key);
+        $this->warn('This is the only time the plaintext key is shown.');
+
+        return self::SUCCESS;
+    }
+}
@@ -0,0 +1,22 @@
+<?php
+
+namespace App\Console\Commands;
+
+use App\Models\License;
+use Illuminate\Console\Command;
+
+class SonarDeskLicenseRevoke extends Command
+{
+    protected $signature = 'sonardesk:license:revoke {id} {--reason=Administrative revocation}';
+
+    protected $description = 'Revoke a SonarDesk licence';
+
+    public function handle(): int
+    {
+        $l = License::findOrFail($this->argument('id'));
+        $l->update(['revoked_at' => now(), 'revoke_reason' => $this->option('reason')]);
+        $this->info('Licence revoked.');
+
+        return self::SUCCESS;
+    }
+}
@@ -0,0 +1,21 @@
+<?php
+
+namespace App\Console\Commands;
+
+use App\Models\LicenseProduct;
+use Illuminate\Console\Command;
+
+class SonarDeskProductCreate extends Command
+{
+    protected $signature = 'sonardesk:product {code} {--name=SonarDesk} {--edition=Professional} {--activations=1} {--max-major=1} {--provider=} {--product-id=} {--price-id=}';
+
+    protected $description = 'Create or update a SonarDesk licensing product';
+
+    public function handle(): int
+    {
+        $p = LicenseProduct::updateOrCreate(['code' => $this->argument('code')], ['name' => $this->option('name'), 'edition' => $this->option('edition'), 'activation_limit' => (int) $this->option('activations'), 'max_major_version' => $this->option('max-major') !== '' ? (int) $this->option('max-major') : null, 'payment_provider' => $this->option('provider') ?: null, 'external_product_id' => $this->option('product-id') ?: null, 'external_price_id' => $this->option('price-id') ?: null, 'active' => true]);
+        $this->info("Product {$p->code} ready.");
+
+        return self::SUCCESS;
+    }
+}
@@ -0,0 +1,49 @@
+<?php
+
+namespace App\Http\Controllers\Admin;
+
+use App\Http\Controllers\Controller;
+use App\Models\License;
+use App\Models\LicenseActivation;
+use App\Models\User;
+use Illuminate\Http\Request;
+
+final class AdminController extends Controller
+{
+    public function index()
+    {
+        return view('admin.index', ['licenseCount' => License::count(), 'activeCount' => License::whereNull('revoked_at')->count(), 'activationCount' => LicenseActivation::whereNull('deactivated_at')->count(), 'userCount' => User::count()]);
+    }
+
+    public function licenses(Request $r)
+    {
+        $q = License::with('product')->latest();
+        if ($s = trim((string) $r->query('q'))) {
+            $q->where(fn ($x) => $x->where('customer_email', 'like', "%{$s}%")->orWhere('customer_name', 'like', "%{$s}%")->orWhere('license_key_last4', 'like', "%{$s}%"));
+        }
+
+return view('admin.licenses', ['licenses' => $q->paginate(50)->withQueryString()]);
+    }
+
+    public function show(License $license)
+    {
+        $license->load(['product', 'activations']);
+
+        return view('admin.license', compact('license'));
+    }
+
+    public function revoke(Request $request, License $license)
+    {
+        $data = $request->validate(['reason' => ['nullable', 'string', 'max:255']]);
+        $license->update(['revoked_at' => now(), 'revoke_reason' => $data['reason'] ?: 'Revoked by administrator']);
+
+        return back()->with('status', 'Licence revoked.');
+    }
+
+    public function restore(License $license)
+    {
+        $license->update(['revoked_at' => null, 'revoke_reason' => null]);
+
+        return back()->with('status','Licence restored.');
+    }
+}
@@ -0,0 +1,35 @@
+<?php
+
+namespace App\Http\Controllers\Admin;
+
+use App\Http\Controllers\Controller;
+use App\Models\CmsPage;
+use Illuminate\Http\Request;
+use Illuminate\Support\Str;
+use Illuminate\Validation\Rule;
+
+final class CmsPageController extends Controller
+{
+    public function index() { return view('admin.cms.index', ['pages' => CmsPage::latest()->paginate(25)]); }
+    public function create() { return view('admin.cms.form', ['page' => new CmsPage()]); }
+    public function store(Request $request) { $page = CmsPage::create($this->validated($request)); return redirect()->route('admin.cms.edit', $page)->with('status', 'Page created.'); }
+    public function edit(CmsPage $page) { return view('admin.cms.form', compact('page')); }
+    public function update(Request $request, CmsPage $page) { $page->update($this->validated($request, $page)); return back()->with('status', 'Page updated.'); }
+    public function destroy(CmsPage $page) { $page->delete(); return redirect()->route('admin.cms.index')->with('status', 'Page deleted.'); }
+
+    private function validated(Request $request, ?CmsPage $page = null): array
+    {
+        $request->merge(['slug' => Str::slug($request->input('slug') ?: $request->input('title', ''))]);
+        $data = $request->validate([
+            'title' => ['required','string','max:160'],
+            'slug' => ['required','string','max:180', Rule::unique('cms_pages','slug')->ignore($page?->id)],
+            'excerpt' => ['nullable','string','max:1000'],
+            'body' => ['required','string'],
+            'meta_title' => ['nullable','string','max:160'],
+            'meta_description' => ['nullable','string','max:320'],
+        ]);
+        $data['is_published'] = $request->boolean('is_published');
+        $data['published_at'] = $data['is_published'] ? ($page?->published_at ?? now()) : null;
+        return $data;
+    }
+}
@@ -0,0 +1,59 @@
+<?php
+
+namespace App\Http\Controllers\Admin;
+
+use App\Http\Controllers\Controller;
+use App\Models\SupportTicket;
+use App\Models\User;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+
+final class SupportTicketController extends Controller
+{
+    public function index(Request $request)
+    {
+        $tickets = SupportTicket::query()
+            ->with('assignee')
+            ->when($request->filled('status'), fn ($q) => $q->where('status', $request->string('status')))
+            ->latest()
+            ->paginate(50)
+            ->withQueryString();
+
+        return view('admin.support.index', compact('tickets'));
+    }
+
+    public function show(SupportTicket $ticket)
+    {
+        $ticket->load(['user', 'assignee']);
+        if (auth()->user()) {
+            auth()->user()->unreadNotifications()->get()
+                ->filter(fn ($notification) => (int) ($notification->data['support_ticket_id'] ?? 0) === $ticket->id)
+                ->each->markAsRead();
+        }
+
+        return view('admin.support.show', [
+            'ticket' => $ticket,
+            'admins' => User::query()->where('is_admin', true)->orderBy('name')->get(['id', 'name', 'email']),
+        ]);
+    }
+
+    public function update(Request $request, SupportTicket $ticket): RedirectResponse
+    {
+        $data = $request->validate([
+            'status' => ['required', 'in:new,open,waiting,resolved,closed'],
+            'priority' => ['required', 'in:low,normal,high,urgent'],
+            'assigned_to' => ['nullable', 'integer', 'exists:users,id'],
+        ]);
+
+        if ($data['assigned_to'] ?? null) {
+            abort_unless(User::whereKey($data['assigned_to'])->where('is_admin', true)->exists(), 422);
+        }
+
+        $data['resolved_at'] = in_array($data['status'], ['resolved', 'closed'], true)
+            ? ($ticket->resolved_at ?? now())
+            : null;
+        $ticket->update($data);
+
+        return back()->with('status', 'Support ticket updated.');
+    }
+}
@@ -0,0 +1,164 @@
+<?php
+
+namespace App\Http\Controllers\Api;
+
+use App\Http\Controllers\Controller;
+use App\Models\License;
+use App\Models\LicenseActivation;
+use App\Services\Licensing\LicenseKey;
+use App\Services\Licensing\LicenseSigner;
+use App\Services\Licensing\LicenseTokenVerifier;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Validation\ValidationException;
+
+final class LicenseActivationController extends Controller
+{
+    public function activate(Request $request, LicenseSigner $signer): JsonResponse
+    {
+        $data = $request->validate([
+            'licenseKey' => ['required', 'string', 'max:128'],
+            'installationID' => ['required', 'uuid'],
+            'appVersion' => ['required', 'string', 'max:32'],
+            'platform' => ['required', 'string', 'max:32'],
+        ]);
+
+        return DB::transaction(function () use ($data, $signer) {
+            $license = License::where('license_key_hash', LicenseKey::hash($data['licenseKey']))
+                ->lockForUpdate()
+                ->first();
+
+            if (! $license) {
+                throw ValidationException::withMessages(['licenseKey' => 'The licence key is not valid.']);
+            }
+
+            if (! $license->is_usable) {
+                return response()->json(['message' => 'This licence is expired or has been revoked.'], 403);
+            }
+
+            $installationID = strtolower($data['installationID']);
+            $activation = LicenseActivation::where('license_id', $license->id)
+                ->where('installation_id', $installationID)
+                ->first();
+
+            if ($activation && $activation->deactivated_at === null) {
+                $activation->update([
+                    'last_seen_at' => now(),
+                    'platform' => $data['platform'],
+                    'app_version' => $data['appVersion'],
+                ]);
+            } else {
+                $activeCount = LicenseActivation::where('license_id', $license->id)
+                    ->whereNull('deactivated_at')
+                    ->count();
+
+                if ($activeCount >= $license->activation_limit) {
+                    return response()->json(['message' => 'This licence has reached its activation limit. Deactivate another Mac first.'], 409);
+                }
+
+                if ($activation) {
+                    $activation->update([
+                        'deactivated_at' => null,
+                        'activated_at' => now(),
+                        'last_seen_at' => now(),
+                        'platform' => $data['platform'],
+                        'app_version' => $data['appVersion'],
+                    ]);
+                } else {
+                    LicenseActivation::create([
+                        'license_id' => $license->id,
+                        'installation_id' => $installationID,
+                        'platform' => $data['platform'],
+                        'app_version' => $data['appVersion'],
+                        'activated_at' => now(),
+                        'last_seen_at' => now(),
+                    ]);
+                }
+            }
+
+            return response()->json([
+                'licenseToken' => $signer->sign($license, $data['installationID']),
+            ]);
+        });
+    }
+
+    public function validateInstallation(
+        Request $request,
+        LicenseTokenVerifier $verifier,
+        LicenseSigner $signer,
+    ): JsonResponse {
+        $data = $request->validate([
+            'licenseToken' => ['required', 'string', 'max:8192'],
+            'installationID' => ['required', 'uuid'],
+            'appVersion' => ['required', 'string', 'max:32'],
+            'platform' => ['required', 'string', 'max:32'],
+        ]);
+
+        try {
+            $payload = $verifier->verify($data['licenseToken']);
+        } catch (\Throwable) {
+            return response()->json(['message' => 'The licence token is invalid.'], 400);
+        }
+
+        if (strcasecmp((string) ($payload['installationID'] ?? ''), $data['installationID']) !== 0) {
+            return response()->json(['message' => 'The installation does not match this licence token.'], 400);
+        }
+
+        return DB::transaction(function () use ($data, $payload, $signer) {
+            $license = License::whereKey((string) ($payload['licenseID'] ?? ''))
+                ->lockForUpdate()
+                ->first();
+
+            if (! $license || ! $license->is_usable) {
+                return response()->json(['message' => 'This licence is expired or has been revoked.'], 403);
+            }
+
+            $activation = LicenseActivation::where('license_id', $license->id)
+                ->where('installation_id', strtolower($data['installationID']))
+                ->first();
+
+            if (! $activation || $activation->deactivated_at !== null) {
+                return response()->json(['message' => 'This Mac has been deactivated from the licence portal.'], 403);
+            }
+
+            $activation->update([
+                'last_seen_at' => now(),
+                'platform' => $data['platform'],
+                'app_version' => $data['appVersion'],
+            ]);
+
+            return response()->json([
+                'active' => true,
+                // Refreshing the signed token also applies subscription edition/expiry changes
+                // without requiring the user to reactivate manually.
+                'licenseToken' => $signer->sign($license, $data['installationID']),
+            ]);
+        });
+    }
+
+    public function deactivate(Request $request, LicenseTokenVerifier $verifier): JsonResponse
+    {
+        $data = $request->validate([
+            'licenseToken' => ['required', 'string', 'max:8192'],
+            'installationID' => ['required', 'uuid'],
+        ]);
+
+        try {
+            $payload = $verifier->verify($data['licenseToken']);
+        } catch (\Throwable) {
+            return response()->json(['message' => 'The licence token is invalid.'], 400);
+        }
+
+        if (strcasecmp((string) ($payload['installationID'] ?? ''), $data['installationID']) !== 0) {
+            return response()->json(['message' => 'The installation does not match this licence token.'], 400);
+        }
+
+        LicenseActivation::where('license_id', (string) ($payload['licenseID'] ?? ''))
+            ->where('installation_id', strtolower($data['installationID']))
+            ->whereNull('deactivated_at')
+            ->update(['deactivated_at' => now(), 'last_seen_at' => now()]);
+
+        return response()->json((object) []);
+    }
+}
@@ -0,0 +1,78 @@
+<?php
+
+namespace App\Http\Controllers\Api;
+
+use App\Http\Controllers\Controller;
+use App\Models\LicenseWebhookEvent;
+use App\Services\Licensing\LicenseDeliveryService;
+use App\Services\Payments\LemonSqueezyWebhookVerifier;
+use App\Services\Payments\PaddleWebhookVerifier;
+use App\Services\Payments\PurchaseProvisioner;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\DB;
+
+final class PaymentWebhookController extends Controller
+{
+    public function __invoke(string $provider, Request $request, PurchaseProvisioner $provisioner, LicenseDeliveryService $delivery): JsonResponse
+    {
+        $raw = (string) $request->getContent();
+        $verifier = match ($provider) {
+            'paddle' => app(PaddleWebhookVerifier::class),'lemon-squeezy' => app(LemonSqueezyWebhookVerifier::class),default => null
+        };
+        if (! $verifier) {
+            return response()->json(['message' => 'Unknown webhook provider.'], 404);
+        }
+        try {
+            $verifier->verify($request, $raw);
+        } catch (\Throwable $e) {
+            report($e);
+
+            return response()->json(['message' => 'Invalid webhook signature.'], 400);
+        }
+        try {
+            $payload = json_decode($raw, true, flags: JSON_THROW_ON_ERROR);
+        } catch (\Throwable) {
+            return response()->json(['message' => 'Invalid JSON.'], 400);
+        }
+        $externalID = (string) ($provider === 'paddle' ? ($payload['event_id'] ?? '') : ($payload['meta']['event_name'] ?? '').':'.($payload['data']['id'] ?? ''));
+        $eventType = (string) ($provider === 'paddle' ? ($payload['event_type'] ?? 'unknown') : ($payload['meta']['event_name'] ?? 'unknown'));
+        if ($externalID === '') {
+            return response()->json(['message' => 'Webhook event has no stable identifier.'], 400);
+        }
+
+        try {
+            DB::transaction(function () use ($provider, $externalID, $eventType, $payload, $raw, $provisioner) {
+                $event = LicenseWebhookEvent::firstOrCreate(['provider' => $provider, 'external_event_id' => $externalID], ['event_type' => $eventType, 'payload_sha256' => hash('sha256', $raw), 'payload' => $payload]);
+                if ($event->processed_at) {
+                    return;
+                }
+                if (! hash_equals($event->payload_sha256, hash('sha256', $raw))) {
+                    throw new \RuntimeException('Webhook ID was reused with a different payload.');
+                }
+                try {
+                    $provisioner->provision($provider, $payload);
+                    $event->update(['processed_at' => now(), 'processing_error' => null]);
+                } catch (\Throwable $e) {
+                    $event->update(['processing_error' => mb_substr($e->getMessage(), 0, 4000)]);
+                    throw $e;
+                }
+            });
+        } catch (\Throwable $e) {
+            report($e);
+
+            return response()->json(['message' => 'Webhook could not be processed.'], 500);
+        }
+
+        // Delivery is intentionally outside the webhook transaction. A temporary mail
+        // outage must not roll back an otherwise valid Paddle event. Pending outbox
+        // rows remain available for portal resend or a later webhook delivery attempt.
+        try {
+            $delivery->deliverPending(10);
+        } catch (\Throwable $e) {
+            report($e);
+        }
+
+        return response()->json(['ok' => true]);
+    }
+}
@@ -0,0 +1,35 @@
+<?php
+
+namespace App\Http\Controllers\Auth;
+
+use App\Http\Controllers\Controller;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Auth;
+
+final class AuthenticatedSessionController extends Controller
+{
+    public function create()
+    {
+        return view('auth.login');
+    }
+
+    public function store(Request $request)
+    {
+        $credentials = $request->validate(['email' => ['required', 'email'], 'password' => ['required', 'string']]);
+        if (! Auth::attempt(['email' => strtolower($credentials['email']), 'password' => $credentials['password']], $request->boolean('remember'))) {
+            return back()->withErrors(['email' => 'The supplied credentials are invalid.'])->onlyInput('email');
+        }
+        $request->session()->regenerate();
+
+        return redirect()->intended(route('portal.index'));
+    }
+
+    public function destroy(Request $request)
+    {
+        Auth::logout();
+        $request->session()->invalidate();
+        $request->session()->regenerateToken();
+
+        return redirect()->route('login');
+    }
+}
@@ -0,0 +1,31 @@
+<?php
+
+namespace App\Http\Controllers\Auth;
+
+use App\Http\Controllers\Controller;
+use Illuminate\Foundation\Auth\EmailVerificationRequest;
+use Illuminate\Http\Request;
+
+final class EmailVerificationController extends Controller
+{
+    public function notice()
+    {
+        return view('auth.verify-email');
+    }
+
+    public function verify(EmailVerificationRequest $request)
+    {
+        $request->fulfill();
+
+        return redirect()->route('portal.index')->with('status', 'Email verified.');
+    }
+
+    public function resend(Request $request)
+    {
+        if (! $request->user()->hasVerifiedEmail()) {
+            $request->user()->sendEmailVerificationNotification();
+        }
+
+return back()->with('status', 'Verification link sent.');
+    }
+}
@@ -0,0 +1,43 @@
+<?php
+
+namespace App\Http\Controllers\Auth;
+
+use App\Http\Controllers\Controller;
+use App\Models\User;
+use Illuminate\Auth\Events\PasswordReset;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Password;
+use Illuminate\Support\Str;
+use Illuminate\Validation\Rules\Password as PasswordRule;
+
+final class PasswordController extends Controller
+{
+    public function requestForm()
+    {
+        return view('auth.forgot-password');
+    }
+
+    public function email(Request $request)
+    {
+        $request->validate(['email' => ['required', 'email']]);
+        $status = Password::sendResetLink(['email' => strtolower($request->email)]);
+
+        return $status === Password::RESET_LINK_SENT ? back()->with('status', __($status)) : back()->withErrors(['email' => __($status)]);
+    }
+
+    public function resetForm(Request $request, string $token)
+    {
+        return view('auth.reset-password', ['token' => $token, 'email' => $request->query('email')]);
+    }
+
+    public function reset(Request $request)
+    {
+        $data = $request->validate(['token' => ['required'], 'email' => ['required', 'email'], 'password' => ['required', 'confirmed', PasswordRule::min(12)->letters()->mixedCase()->numbers()]]);
+        $status = Password::reset($data, function (User $user, string $password) {
+            $user->forceFill(['password' => $password, 'remember_token' => Str::random(60)])->save();
+            event(new PasswordReset($user));
+        });
+
+        return $status === Password::PASSWORD_RESET ? redirect()->route('login')->with('status', __($status)) : back()->withErrors(['email' => __($status)]);
+    }
+}
@@ -0,0 +1,29 @@
+<?php
+
+namespace App\Http\Controllers\Auth;
+
+use App\Http\Controllers\Controller;
+use App\Models\User;
+use Illuminate\Auth\Events\Registered;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\Validation\Rules\Password;
+
+final class RegisteredUserController extends Controller
+{
+    public function create()
+    {
+        return view('auth.register');
+    }
+
+    public function store(Request $request)
+    {
+        $data = $request->validate(['name' => ['required', 'string', 'max:120'], 'email' => ['required', 'email', 'max:255', 'unique:users,email'], 'password' => ['required', 'confirmed', Password::min(12)->letters()->mixedCase()->numbers()]]);
+        $user = User::create(['name' => $data['name'], 'email' => strtolower($data['email']), 'password' => $data['password']]);
+        event(new Registered($user));
+        Auth::login($user);
+        $request->session()->regenerate();
+
+        return redirect()->route('verification.notice');
+    }
+}
@@ -0,0 +1,38 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use Illuminate\Contracts\View\View;
+use RuntimeException;
+
+final class CheckoutController extends Controller
+{
+    public function __invoke(): View
+    {
+        $paddle = config('sonardesk.paddle');
+        $token = trim((string) ($paddle['client_side_token'] ?? ''));
+
+        if ($token === '') {
+            throw new RuntimeException('PADDLE_CLIENT_SIDE_TOKEN is not configured.');
+        }
+
+        $plans = [
+            'personal-monthly' => ['name' => 'Personal', 'billing' => 'Monthly', 'display_price' => '£1.99 / month', 'price_id' => $paddle['personal_monthly_price_id'], 'activation_limit' => 1],
+            'personal-annual' => ['name' => 'Personal', 'billing' => 'Annual', 'display_price' => '£14.99 / year', 'price_id' => $paddle['personal_annual_price_id'], 'activation_limit' => 1],
+            'professional-monthly' => ['name' => 'Professional', 'billing' => 'Monthly', 'display_price' => '£3.99 / month', 'price_id' => $paddle['professional_monthly_price_id'], 'activation_limit' => 3],
+            'professional-annual' => ['name' => 'Professional', 'billing' => 'Annual', 'display_price' => '£29.99 / year', 'price_id' => $paddle['professional_annual_price_id'], 'activation_limit' => 3],
+        ];
+
+        foreach ($plans as $plan) {
+            if (trim((string) $plan['price_id']) === '') {
+                throw new RuntimeException('One or more Paddle price IDs are not configured.');
+            }
+        }
+
+        return view('checkout.buy', [
+            'plans' => $plans,
+            'paddleToken' => $token,
+            'paddleEnvironment' => (string) ($paddle['environment'] ?? 'sandbox'),
+        ]);
+    }
+}
@@ -0,0 +1,14 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Models\CmsPage;
+
+final class CmsPageController extends Controller
+{
+    public function show(string $slug)
+    {
+        $page = CmsPage::where('slug', $slug)->where('is_published', true)->where(fn ($q) => $q->whereNull('published_at')->orWhere('published_at', '<=', now()))->firstOrFail();
+        return view('cms.show', compact('page'));
+    }
+}
@@ -0,0 +1,8 @@
+<?php
+
+namespace App\Http\Controllers;
+
+abstract class Controller
+{
+    // Application controller base class.
+}
@@ -0,0 +1,142 @@
+<?php
+
+namespace App\Http\Controllers\Portal;
+
+use App\Http\Controllers\Controller;
+use App\Models\License;
+use App\Models\LicenseDeliveryOutbox;
+use App\Models\LicenseProduct;
+use App\Services\Payments\PaddleClient;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Crypt;
+use Illuminate\Support\Facades\Mail;
+use RuntimeException;
+
+final class PortalController extends Controller
+{
+    public function __construct(private PaddleClient $paddle) {}
+
+    private function owned(Request $request)
+    {
+        return License::with(['product', 'activations'])
+            ->whereRaw('lower(customer_email) = ?', [strtolower($request->user()->email)]);
+    }
+
+    public function index(Request $request)
+    {
+        $licenses = $this->owned($request)->latest()->get();
+        $hasProfessional = $licenses->contains(fn (License $license) => $license->is_usable && $license->edition === 'Professional');
+
+        return view('portal.index', compact('licenses', 'hasProfessional'));
+    }
+
+    public function show(Request $request, License $license)
+    {
+        $this->authorise($request, $license);
+        $license->load(['product', 'activations']);
+
+        return view('portal.show', compact('license'));
+    }
+
+    public function upgrade(Request $request, License $license): RedirectResponse
+    {
+        $this->authorise($request, $license);
+        abort_unless($license->payment_provider === 'paddle' && $license->external_subscription_id, 422);
+        abort_unless($license->edition === 'Personal' && $license->is_usable, 422);
+
+        $targetPriceID = $this->professionalPriceFor($license);
+        $targetProduct = LicenseProduct::query()
+            ->where('payment_provider', 'paddle')
+            ->where('external_price_id', $targetPriceID)
+            ->where('active', true)
+            ->firstOrFail();
+
+        try {
+            $subscription = $this->paddle->updateSubscriptionPrice($license->external_subscription_id, $targetPriceID);
+        } catch (RuntimeException $exception) {
+            return back()->withErrors(['licence' => $exception->getMessage()]);
+        }
+
+        // Apply the entitlement immediately. Paddle webhooks remain authoritative and
+        // will reconcile subscription status/current-period details afterwards.
+        $license->update([
+            'license_product_id' => $targetProduct->id,
+            'edition' => $targetProduct->edition,
+            'activation_limit' => $targetProduct->activation_limit,
+            'max_major_version' => $targetProduct->max_major_version,
+            'external_price_id' => $targetPriceID,
+            'subscription_status' => (string) ($subscription['status'] ?? $license->subscription_status),
+            'revoked_at' => null,
+            'revoke_reason' => null,
+        ]);
+
+        return redirect()->route('portal.show', $license)->with('status', 'Upgraded to Professional. Your existing Paddle subscription was changed; no second subscription was created.');
+    }
+
+    public function cancel(Request $request, License $license): RedirectResponse
+    {
+        $this->authorise($request, $license);
+        abort_unless($license->payment_provider === 'paddle' && $license->external_subscription_id, 422);
+        abort_unless(! in_array($license->subscription_status, ['canceled'], true), 422);
+
+        try {
+            $this->paddle->cancelSubscriptionImmediately($license->external_subscription_id);
+        } catch (RuntimeException $exception) {
+            return back()->withErrors(['licence' => $exception->getMessage()]);
+        }
+
+        $license->update([
+            'subscription_status' => 'canceled',
+            'expires_at' => now(),
+            'revoked_at' => now(),
+            'revoke_reason' => 'Subscription canceled from licence portal',
+            'cancel_scheduled_at' => null,
+        ]);
+
+        return redirect()->route('portal.index')->with('status', 'Subscription canceled in Paddle and the licence is no longer active.');
+    }
+
+    public function deactivate(Request $request, License $license, int $activation)
+    {
+        $this->authorise($request, $license);
+        $item = $license->activations()->whereKey($activation)->firstOrFail();
+        if (! $item->deactivated_at) {
+            $item->update(['deactivated_at' => now()]);
+        }
+
+        return back()->with('status', 'Mac deactivated. SonarDesk will detect this through the licensing API.');
+    }
+
+    public function resend(Request $request, License $license)
+    {
+        $this->authorise($request, $license);
+        $out = LicenseDeliveryOutbox::where('license_id', $license->id)->first();
+        if (! $out) {
+            return back()->withErrors(['licence' => 'This licence was issued manually and its full key is not recoverable. Contact support.']);
+        }
+
+        $plain = Crypt::decryptString($out->encrypted_license_key);
+        Mail::raw("Your SonarDesk licence key is:\n\n{$plain}\n\nKeep this key private.", fn ($m) => $m->to($request->user()->email)->subject('Your SonarDesk licence key'));
+        $out->update(['delivered_at' => now()]);
+
+        return back()->with('status', 'Licence key sent to your verified email address.');
+    }
+
+    private function authorise(Request $request, License $license): void
+    {
+        abort_unless(strtolower((string) $license->customer_email) === strtolower($request->user()->email), 404);
+    }
+
+    private function professionalPriceFor(License $license): string
+    {
+        $paddle = config('sonardesk.paddle');
+        $current = (string) $license->external_price_id;
+
+        if ($current === (string) ($paddle['personal_annual_price_id'] ?? '')) {
+            return (string) ($paddle['professional_annual_price_id'] ?? '');
+        }
+
+        return (string) ($paddle['professional_monthly_price_id'] ?? '');
+    }
+}
@@ -0,0 +1,92 @@
+<?php
+
+namespace App\Http\Controllers\Support;
+
+use App\Http\Controllers\Controller;
+use App\Models\SupportTicket;
+use App\Models\User;
+use App\Notifications\NewSupportTicket;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Mail;
+use Illuminate\Support\Facades\Notification;
+use Illuminate\Support\Str;
+
+final class SupportController extends Controller
+{
+    public function create(Request $request)
+    {
+        return view('support', [
+            'categories' => [
+                'technical' => 'Technical support',
+                'licensing' => 'Licence & activation',
+                'billing' => 'Billing & subscription',
+                'feature' => 'Feature request',
+                'privacy' => 'Privacy / data request',
+                'general' => 'General enquiry',
+            ],
+        ]);
+    }
+
+    public function store(Request $request): RedirectResponse
+    {
+        // Honeypot: bots tend to fill hidden fields. Return success without retaining spam.
+        if (filled($request->input('company_website'))) {
+            return back()->with('status', 'Your support request has been received.');
+        }
+
+        $data = $request->validate([
+            'name' => ['required', 'string', 'max:120'],
+            'email' => ['required', 'email:rfc', 'max:254'],
+            'category' => ['required', 'in:technical,licensing,billing,feature,privacy,general'],
+            'subject' => ['required', 'string', 'max:180'],
+            'message' => ['required', 'string', 'min:10', 'max:10000'],
+            'privacy_notice' => ['accepted'],
+        ]);
+
+        $ticket = SupportTicket::create([
+            'user_id' => $request->user()?->id,
+            'reference' => $this->reference(),
+            'name' => $data['name'],
+            'email' => strtolower($data['email']),
+            'category' => $data['category'],
+            'subject' => $data['subject'],
+            'message' => $data['message'],
+            'privacy_notice_accepted_at' => now(),
+        ]);
+
+        $this->notifyTeam($ticket);
+
+        Mail::raw(
+            "We received your SonarDesk support request.\n\nReference: {$ticket->reference}\nSubject: {$ticket->subject}\n\nWe will reply to this email address. Please keep the reference in any follow-up.",
+            fn ($mail) => $mail->to($ticket->email)->subject("SonarDesk support request {$ticket->reference}")
+        );
+
+        return redirect()->route('support')->with('status', "Support request {$ticket->reference} received. A confirmation has been emailed to you.");
+    }
+
+    private function notifyTeam(SupportTicket $ticket): void
+    {
+        if (config('sonardesk.support.notify_admin_users', true)) {
+            User::query()->where('is_admin', true)->get()->each->notify(new NewSupportTicket($ticket));
+        }
+
+        $emails = collect(config('sonardesk.support.alert_emails', []))
+            ->filter(fn ($email) => filter_var($email, FILTER_VALIDATE_EMAIL))
+            ->unique()
+            ->values();
+
+        if ($emails->isNotEmpty()) {
+            Notification::route('mail', $emails->all())->notify(new NewSupportTicket($ticket));
+        }
+    }
+
+    private function reference(): string
+    {
+        do {
+            $reference = 'RS-'.now()->format('ymd').'-'.Str::upper(Str::random(6));
+        } while (SupportTicket::where('reference', $reference)->exists());
+
+        return $reference;
+    }
+}
@@ -0,0 +1,17 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpFoundation\Response;
+
+final class AdminOnly
+{
+    public function handle(Request $request, Closure $next): Response
+    {
+        abort_unless($request->user()?->is_admin === true, 403);
+
+        return $next($request);
+    }
+}
@@ -0,0 +1,15 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Model;
+
+final class CmsPage extends Model
+{
+    protected $fillable = ['title', 'slug', 'excerpt', 'body', 'meta_title', 'meta_description', 'is_published', 'published_at'];
+
+    protected function casts(): array
+    {
+        return ['is_published' => 'boolean', 'published_at' => 'datetime'];
+    }
+}
@@ -0,0 +1,36 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Concerns\HasUuids;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+use Illuminate\Database\Eloquent\Relations\HasMany;
+
+class License extends Model
+{
+    use HasUuids;
+
+    public $incrementing = false;
+
+    protected $keyType = 'string';
+
+    protected $fillable = ['license_product_id', 'license_key_hash', 'license_key_last4', 'customer_name', 'customer_email', 'edition', 'activation_limit', 'max_major_version', 'expires_at', 'revoked_at', 'revoke_reason', 'payment_provider', 'external_order_id', 'external_customer_id', 'external_subscription_id', 'external_price_id', 'subscription_status', 'current_period_ends_at', 'cancel_scheduled_at'];
+
+    protected $casts = ['expires_at' => 'datetime', 'revoked_at' => 'datetime', 'activation_limit' => 'integer', 'max_major_version' => 'integer', 'current_period_ends_at' => 'datetime', 'cancel_scheduled_at' => 'datetime'];
+
+    public function product(): BelongsTo
+    {
+        return $this->belongsTo(LicenseProduct::class, 'license_product_id');
+    }
+
+    public function activations(): HasMany
+    {
+        return $this->hasMany(LicenseActivation::class);
+    }
+
+    public function getIsUsableAttribute(): bool
+    {
+        return $this->revoked_at === null && ($this->expires_at === null || $this->expires_at->isFuture());
+    }
+}
@@ -0,0 +1,14 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Model;
+
+class LicenseActivation extends Model
+{
+    public $timestamps = false;
+
+    protected $fillable = ['license_id', 'installation_id', 'installation_name', 'platform', 'app_version', 'activated_at', 'last_seen_at', 'deactivated_at'];
+
+    protected $casts = ['activated_at' => 'datetime', 'last_seen_at' => 'datetime', 'deactivated_at' => 'datetime'];
+}
@@ -0,0 +1,14 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Model;
+
+class LicenseDeliveryOutbox extends Model
+{
+    protected $table = 'license_delivery_outbox';
+
+    protected $fillable = ['license_id', 'encrypted_license_key', 'recipient_email', 'delivered_at'];
+
+    protected $casts = ['delivered_at' => 'datetime'];
+}
@@ -0,0 +1,12 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Model;
+
+class LicenseProduct extends Model
+{
+    protected $fillable = ['code', 'name', 'edition', 'activation_limit', 'max_major_version', 'payment_provider', 'external_product_id', 'external_price_id', 'active'];
+
+    protected $casts = ['active' => 'boolean', 'activation_limit' => 'integer', 'max_major_version' => 'integer'];
+}
@@ -0,0 +1,12 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Model;
+
+class LicenseWebhookEvent extends Model
+{
+    protected $fillable = ['provider', 'external_event_id', 'event_type', 'payload_sha256', 'payload', 'processed_at', 'processing_error'];
+
+    protected $casts = ['payload' => 'array', 'processed_at' => 'datetime'];
+}
@@ -0,0 +1,46 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Prunable;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+
+class SupportTicket extends Model
+{
+    use Prunable;
+
+    protected $fillable = [
+        'user_id', 'assigned_to', 'reference', 'name', 'email', 'category',
+        'subject', 'message', 'status', 'priority', 'privacy_notice_accepted_at',
+        'resolved_at',
+    ];
+
+    protected function casts(): array
+    {
+        return [
+            'privacy_notice_accepted_at' => 'datetime',
+            'resolved_at' => 'datetime',
+        ];
+    }
+
+    public function user(): BelongsTo
+    {
+        return $this->belongsTo(User::class);
+    }
+
+    public function assignee(): BelongsTo
+    {
+        return $this->belongsTo(User::class, 'assigned_to');
+    }
+
+    public function prunable(): Builder
+    {
+        $days = max(30, (int) config('sonardesk.privacy.support_retention_days', 730));
+
+        return static::query()
+            ->whereNotNull('resolved_at')
+            ->where('resolved_at', '<=', now()->subDays($days));
+    }
+}
@@ -0,0 +1,22 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Contracts\Auth\MustVerifyEmail;
+use Illuminate\Database\Eloquent\Factories\HasFactory;
+use Illuminate\Foundation\Auth\User as Authenticatable;
+use Illuminate\Notifications\Notifiable;
+
+class User extends Authenticatable implements MustVerifyEmail
+{
+    use HasFactory, Notifiable;
+
+    protected $fillable = ['name', 'email', 'password', 'is_admin'];
+
+    protected $hidden = ['password', 'remember_token'];
+
+    protected function casts(): array
+    {
+        return ['email_verified_at' => 'datetime', 'password' => 'hashed', 'is_admin' => 'boolean'];
+    }
+}
@@ -0,0 +1,43 @@
+<?php
+
+namespace App\Notifications;
+
+use App\Models\SupportTicket;
+use Illuminate\Bus\Queueable;
+use Illuminate\Notifications\AnonymousNotifiable;
+use Illuminate\Notifications\Messages\MailMessage;
+use Illuminate\Notifications\Notification;
+
+class NewSupportTicket extends Notification
+{
+    use Queueable;
+
+    public function __construct(public readonly SupportTicket $ticket) {}
+
+    public function via(object $notifiable): array
+    {
+        return $notifiable instanceof AnonymousNotifiable ? ['mail'] : ['database', 'mail'];
+    }
+
+    public function toMail(object $notifiable): MailMessage
+    {
+        return (new MailMessage)
+            ->subject("New SonarDesk support request {$this->ticket->reference}")
+            ->greeting('New support request')
+            ->line("{$this->ticket->name} <{$this->ticket->email}>")
+            ->line("Category: {$this->ticket->category}")
+            ->line("Subject: {$this->ticket->subject}")
+            ->line($this->ticket->message)
+            ->action('Open support ticket', route('admin.support.show', $this->ticket));
+    }
+
+    public function toArray(object $notifiable): array
+    {
+        return [
+            'support_ticket_id' => $this->ticket->id,
+            'reference' => $this->ticket->reference,
+            'subject' => $this->ticket->subject,
+            'email' => $this->ticket->email,
+        ];
+    }
+}
@@ -0,0 +1,26 @@
+<?php
+
+namespace App\Providers;
+
+use Illuminate\Cache\RateLimiting\Limit;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\RateLimiter;
+use Illuminate\Support\ServiceProvider;
+
+final class SonarDeskLicensingServiceProvider extends ServiceProvider
+{
+    public function boot(): void
+    {
+        RateLimiter::for('license-activation', function (Request $request): array {
+            return [
+                Limit::perMinute(12)->by($request->ip()),
+                Limit::perMinute(6)->by(hash('sha256', (string) $request->input('installationID'))),
+            ];
+        });
+
+        RateLimiter::for('login', fn (Request $request) => Limit::perMinute(5)
+            ->by(strtolower((string) $request->input('email')).'|'.$request->ip()));
+
+        RateLimiter::for('registration', fn (Request $request) => Limit::perHour(5)->by($request->ip()));
+    }
+}
@@ -0,0 +1,40 @@
+<?php
+
+namespace App\Services\Licensing;
+
+use App\Models\LicenseDeliveryOutbox;
+use Illuminate\Support\Facades\Crypt;
+use Illuminate\Support\Facades\Mail;
+
+final class LicenseDeliveryService
+{
+    public function deliverPending(int $limit = 20): int
+    {
+        $delivered = 0;
+        $pending = LicenseDeliveryOutbox::query()
+            ->whereNull('delivered_at')
+            ->whereNotNull('recipient_email')
+            ->where('recipient_email', '!=', '')
+            ->oldest()
+            ->limit(max(1, min($limit, 100)))
+            ->get();
+
+        foreach ($pending as $outbox) {
+            $plain = Crypt::decryptString($outbox->encrypted_license_key);
+            $recipient = strtolower(trim((string) $outbox->recipient_email));
+            if ($recipient === '') {
+                continue;
+            }
+
+            Mail::raw(
+                "Thank you for choosing SonarDesk.\n\nYour licence key is:\n\n{$plain}\n\nOpen SonarDesk → Settings → Licence and enter this key to activate your Mac.\n\nKeep this key private. You can manage activations from the SonarDesk licence portal.",
+                fn ($message) => $message->to($recipient)->subject('Your SonarDesk licence key')
+            );
+
+            $outbox->update(['delivered_at' => now()]);
+            $delivered++;
+        }
+
+        return $delivered;
+    }
+}
@@ -0,0 +1,46 @@
+<?php
+
+namespace App\Services\Licensing;
+
+use App\Models\License;
+use App\Models\LicenseDeliveryOutbox;
+use App\Models\LicenseProduct;
+use Illuminate\Support\Facades\Crypt;
+use Illuminate\Support\Facades\DB;
+
+final class LicenseIssuer
+{
+    public function issue(LicenseProduct $product, ?string $name, ?string $email, ?string $provider = null, ?string $orderID = null, ?string $customerID = null, bool $queueDelivery = false): array
+    {
+        return DB::transaction(function () use ($product, $name, $email, $provider, $orderID, $customerID, $queueDelivery) {
+            if ($provider && $orderID) {
+                $existing = License::where('payment_provider', $provider)->where('external_order_id', $orderID)->first();
+                if ($existing) {
+                    return [$existing, null];
+                }
+            }
+            $plain = LicenseKey::generate();
+            $license = License::create([
+                'license_product_id' => $product->id,
+                'license_key_hash' => LicenseKey::hash($plain),
+                'license_key_last4' => substr(LicenseKey::normalize($plain), -4),
+                'customer_name' => $name,
+                'customer_email' => $email ? strtolower(trim($email)) : null,
+                'edition' => $product->edition,
+                'activation_limit' => $product->activation_limit,
+                'max_major_version' => $product->max_major_version,
+                'payment_provider' => $provider,
+                'external_order_id' => $orderID,
+                'external_customer_id' => $customerID,
+            ]);
+            if ($queueDelivery) {
+                LicenseDeliveryOutbox::updateOrCreate(
+                    ['license_id' => $license->id],
+                    ['encrypted_license_key' => Crypt::encryptString($plain), 'recipient_email' => $license->customer_email, 'delivered_at' => null]
+                );
+            }
+
+            return [$license, $plain];
+        });
+    }
+}
@@ -0,0 +1,27 @@
+<?php
+
+namespace App\Services\Licensing;
+
+final class LicenseKey
+{
+    public static function generate(): string
+    {
+        $alphabet = 'ABCDEFGHJKLMNPQRSTUVWXYZ23456789';
+        $raw = '';
+        for ($i = 0; $i < 20; $i++) {
+            $raw .= $alphabet[random_int(0, strlen($alphabet) - 1)];
+        }
+
+        return implode('-', str_split($raw, 5));
+    }
+
+    public static function normalize(string $value): string
+    {
+        return strtoupper(preg_replace('/[^A-Z0-9]/i', '', trim($value)) ?? '');
+    }
+
+    public static function hash(string $value): string
+    {
+        return hash('sha256', self::normalize($value));
+    }
+}
@@ -0,0 +1,59 @@
+<?php
+
+namespace App\Services\Licensing;
+
+use App\Models\License;
+use Carbon\CarbonInterface;
+use RuntimeException;
+
+final class LicenseSigner
+{
+    public function sign(License $license, string $installationID, ?CarbonInterface $issuedAt = null): string
+    {
+        $seed = $this->privateSeed();
+        $pair = sodium_crypto_sign_seed_keypair($seed);
+        $secret = sodium_crypto_sign_secretkey($pair);
+
+        $payload = [
+            'customerEmail' => $license->customer_email,
+            'customerName' => $license->customer_name,
+            'edition' => $license->edition,
+            'expiresAt' => $license->expires_at?->utc()->format('Y-m-d\\TH:i:s\\Z'),
+            'installationID' => strtolower($installationID),
+            'issuedAt' => ($issuedAt ?? now())->utc()->format('Y-m-d\\TH:i:s\\Z'),
+            'licenseID' => strtolower((string) $license->id),
+            'maxMajorVersion' => $license->max_major_version,
+        ];
+        ksort($payload, SORT_STRING);
+        $json = json_encode($payload, JSON_UNESCAPED_SLASHES | JSON_THROW_ON_ERROR);
+        $sig = sodium_crypto_sign_detached($json, $secret);
+
+        return 'RS3.'.self::b64url($json).'.'.self::b64url($sig);
+    }
+
+    public function publicKeyBase64(): string
+    {
+        $pair = sodium_crypto_sign_seed_keypair($this->privateSeed());
+
+        return base64_encode(sodium_crypto_sign_publickey($pair));
+    }
+
+    private function privateSeed(): string
+    {
+        $path = config('sonardesk.private_key_path');
+        if (! $path || ! is_file($path)) {
+            throw new RuntimeException('SONARDESK_LICENSE_PRIVATE_KEY_PATH is not configured or does not exist.');
+        }
+        $decoded = base64_decode(trim((string) file_get_contents($path)), true);
+        if ($decoded === false || strlen($decoded) !== SODIUM_CRYPTO_SIGN_SEEDBYTES) {
+            throw new RuntimeException('The SonarDesk private key must be a Base64-encoded 32-byte Ed25519 seed.');
+        }
+
+        return $decoded;
+    }
+
+    private static function b64url(string $value): string
+    {
+        return rtrim(strtr(base64_encode($value), '+/', '-_'), '=');
+    }
+}
@@ -0,0 +1,40 @@
+<?php
+
+namespace App\Services\Licensing;
+
+use RuntimeException;
+
+final class LicenseTokenVerifier
+{
+    public function verify(string $token): array
+    {
+        $parts = explode('.', trim($token));
+        if (count($parts) !== 3 || $parts[0] !== 'RS3') {
+            throw new RuntimeException('Invalid licence token.');
+        }
+        $payload = $this->decode($parts[1]);
+        $signature = $this->decode($parts[2]);
+        $public = base64_decode((string) config('sonardesk.public_key'), true);
+        if ($public === false || strlen($public) !== SODIUM_CRYPTO_SIGN_PUBLICKEYBYTES) {
+            throw new RuntimeException('Server licence public key is invalid.');
+        }
+        if (! sodium_crypto_sign_verify_detached($signature, $payload, $public)) {
+            throw new RuntimeException('Licence token signature is invalid.');
+        }
+        $decoded = json_decode($payload, true, flags: JSON_THROW_ON_ERROR);
+
+        return is_array($decoded) ? $decoded : throw new RuntimeException('Licence token payload is invalid.');
+    }
+
+    private function decode(string $value): string
+    {
+        $value = strtr($value, '-_', '+/');
+        $value .= str_repeat('=', (4 - strlen($value) % 4) % 4);
+        $out = base64_decode($value, true);
+        if ($out === false) {
+            throw new RuntimeException('Invalid Base64URL value.');
+        }
+
+        return $out;
+    }
+}
@@ -0,0 +1,22 @@
+<?php
+
+namespace App\Services\Payments;
+
+use Illuminate\Http\Request;
+use RuntimeException;
+
+final class LemonSqueezyWebhookVerifier implements WebhookVerifier
+{
+    public function verify(Request $request, string $rawBody): void
+    {
+        $secret = (string) config('sonardesk.lemon_squeezy.webhook_secret');
+        $signature = (string) $request->header('X-Signature');
+        if ($secret === '' || $signature === '') {
+            throw new RuntimeException('Lemon Squeezy webhook verification is not configured.');
+        }
+        $expected = hash_hmac('sha256', $rawBody, $secret);
+        if (! hash_equals($expected, $signature)) {
+            throw new RuntimeException('Lemon Squeezy webhook signature is invalid.');
+        }
+    }
+}
@@ -0,0 +1,82 @@
+<?php
+
+namespace App\Services\Payments;
+
+use Illuminate\Http\Client\Response;
+use Illuminate\Support\Facades\Http;
+use RuntimeException;
+
+final class PaddleClient
+{
+    public function customer(?string $customerID): ?array
+    {
+        if (! $customerID || ! config('sonardesk.paddle.api_key')) {
+            return null;
+        }
+
+        $response = $this->request()->get('/customers/'.$customerID);
+
+        if (! $response->successful()) {
+            return null;
+        }
+        $data = $response->json('data');
+
+        return is_array($data) ? $data : null;
+    }
+
+    public function updateSubscriptionPrice(string $subscriptionID, string $priceID): array
+    {
+        $this->requireWritableConfiguration();
+
+        $response = $this->request()->patch('/subscriptions/'.$subscriptionID, [
+            'proration_billing_mode' => 'prorated_immediately',
+            'items' => [[
+                'price_id' => $priceID,
+                'quantity' => 1,
+            ]],
+        ]);
+
+        return $this->subscriptionData($response, 'Paddle could not update the subscription.');
+    }
+
+    public function cancelSubscriptionImmediately(string $subscriptionID): array
+    {
+        $this->requireWritableConfiguration();
+
+        $response = $this->request()->post('/subscriptions/'.$subscriptionID.'/cancel', [
+            'effective_from' => 'immediately',
+        ]);
+
+        return $this->subscriptionData($response, 'Paddle could not cancel the subscription.');
+    }
+
+    private function request()
+    {
+        return Http::baseUrl((string) config('sonardesk.paddle.api_url'))
+            ->withToken((string) config('sonardesk.paddle.api_key'))
+            ->acceptJson()
+            ->timeout(15);
+    }
+
+    private function requireWritableConfiguration(): void
+    {
+        if (trim((string) config('sonardesk.paddle.api_key')) === '') {
+            throw new RuntimeException('Paddle subscription management is not configured.');
+        }
+    }
+
+    private function subscriptionData(Response $response, string $fallback): array
+    {
+        if (! $response->successful()) {
+            $detail = trim((string) ($response->json('error.detail') ?? ''));
+            throw new RuntimeException($detail !== '' ? $detail : $fallback);
+        }
+
+        $data = $response->json('data');
+        if (! is_array($data)) {
+            throw new RuntimeException($fallback);
+        }
+
+        return $data;
+    }
+}
@@ -0,0 +1,38 @@
+<?php
+
+namespace App\Services\Payments;
+
+use Illuminate\Http\Request;
+use RuntimeException;
+
+final class PaddleWebhookVerifier implements WebhookVerifier
+{
+    public function verify(Request $request, string $rawBody): void
+    {
+        $secret = (string) config('sonardesk.paddle.webhook_secret');
+        $header = (string) $request->header('Paddle-Signature');
+        if ($secret === '' || $header === '') {
+            throw new RuntimeException('Paddle webhook verification is not configured.');
+        }
+        $parts = [];
+        foreach (explode(';', $header) as $part) {
+            [$k,$v] = array_pad(explode('=', trim($part), 2), 2, null);
+            if ($k && $v) {
+                $parts[$k][] = $v;
+            }
+        }
+        $ts = isset($parts['ts'][0]) ? (int) $parts['ts'][0] : 0;
+        $signatures = $parts['h1'] ?? [];
+        $tolerance = max(1, (int) config('sonardesk.paddle.timestamp_tolerance', 300));
+        if (! $ts || abs(time() - $ts) > $tolerance) {
+            throw new RuntimeException('Paddle webhook timestamp is outside the allowed tolerance.');
+        }
+        $expected = hash_hmac('sha256', $ts.':'.$rawBody, $secret);
+        foreach ($signatures as $signature) {
+            if (hash_equals($expected, $signature)) {
+                return;
+            }
+        }
+        throw new RuntimeException('Paddle webhook signature is invalid.');
+    }
+}
@@ -0,0 +1,246 @@
+<?php
+
+namespace App\Services\Payments;
+
+use App\Models\License;
+use App\Models\LicenseProduct;
+use App\Services\Licensing\LicenseIssuer;
+use Illuminate\Support\Carbon;
+use RuntimeException;
+
+final class PurchaseProvisioner
+{
+    public function __construct(private LicenseIssuer $issuer, private PaddleClient $paddle) {}
+
+    public function provision(string $provider, array $event): void
+    {
+        if ($provider === 'paddle') {
+            $this->provisionPaddle($event);
+
+            return;
+        }
+
+        if ($provider === 'lemon-squeezy') {
+            $this->provisionLemonSqueezy($event);
+
+            return;
+        }
+
+        throw new RuntimeException('Unsupported payment provider.');
+    }
+
+    private function provisionPaddle(array $event): void
+    {
+        $type = (string) ($event['event_type'] ?? '');
+        $data = $event['data'] ?? [];
+
+        if (str_starts_with($type, 'subscription.')) {
+            $this->syncPaddleSubscription($type, $data);
+
+            return;
+        }
+
+        if ($type === 'transaction.completed') {
+            $this->syncPaddleTransaction($data);
+
+            return;
+        }
+
+        if ($type === 'transaction.refunded') {
+            $transactionID = (string) ($data['id'] ?? '');
+            if ($transactionID !== '') {
+                License::where('payment_provider', 'paddle')
+                    ->where('external_order_id', $transactionID)
+                    ->whereNull('external_subscription_id')
+                    ->whereNull('revoked_at')
+                    ->update(['revoked_at' => now(), 'revoke_reason' => 'Payment refunded']);
+            }
+        }
+    }
+
+    private function syncPaddleSubscription(string $type, array $data): void
+    {
+        $subscriptionID = (string) ($data['id'] ?? '');
+        if ($subscriptionID === '') {
+            throw new RuntimeException('Paddle subscription webhook has no subscription ID.');
+        }
+
+        $status = (string) ($data['status'] ?? '');
+        $item = $this->firstRecurringItem($data['items'] ?? []);
+        $price = $item['price'] ?? [];
+        $priceID = (string) ($price['id'] ?? $item['price_id'] ?? '');
+        $productID = (string) ($price['product_id'] ?? $item['product_id'] ?? '');
+
+        $license = License::where('payment_provider', 'paddle')
+            ->where('external_subscription_id', $subscriptionID)
+            ->first();
+
+        if (! $license) {
+            $product = $this->mappedProduct('paddle', $priceID, $productID);
+            $custom = is_array($data['custom_data'] ?? null) ? $data['custom_data'] : [];
+            $customer = $this->paddle->customer($this->nullableString($data['customer_id'] ?? null));
+            [$license] = $this->issuer->issue(
+                $product,
+                $this->nullableString($custom['customer_name'] ?? $custom['name'] ?? $customer['name'] ?? null),
+                $this->nullableString($custom['customer_email'] ?? $custom['email'] ?? $customer['email'] ?? null),
+                'paddle',
+                $this->nullableString($data['transaction_id'] ?? null),
+                $this->nullableString($data['customer_id'] ?? null),
+                true,
+            );
+            $license->external_subscription_id = $subscriptionID;
+        } elseif ($priceID !== '' && $priceID !== $license->external_price_id) {
+            // Upgrades/downgrades change the entitlement attached to the existing key.
+            $product = $this->mappedProduct('paddle', $priceID, $productID);
+            $license->license_product_id = $product->id;
+            $license->edition = $product->edition;
+            $license->activation_limit = $product->activation_limit;
+            $license->max_major_version = $product->max_major_version;
+        }
+
+        $periodEnd = $data['current_billing_period']['ends_at'] ?? null;
+        $scheduled = $data['scheduled_change'] ?? null;
+        $cancelAt = is_array($scheduled) && ($scheduled['action'] ?? null) === 'cancel'
+            ? ($scheduled['effective_at'] ?? null)
+            : null;
+
+        $license->external_customer_id = $this->nullableString($data['customer_id'] ?? null) ?? $license->external_customer_id;
+        $license->external_price_id = $priceID !== '' ? $priceID : $license->external_price_id;
+        $license->subscription_status = $status !== '' ? $status : $license->subscription_status;
+        $license->current_period_ends_at = $periodEnd ? Carbon::parse($periodEnd) : $license->current_period_ends_at;
+        $license->cancel_scheduled_at = $cancelAt ? Carbon::parse($cancelAt) : null;
+
+        if (in_array($status, ['active', 'trialing'], true)) {
+            $license->revoked_at = null;
+            $license->revoke_reason = null;
+            // Trialing/active subscriptions remain valid through the current period.
+            $license->expires_at = $periodEnd ? Carbon::parse($periodEnd) : null;
+        } elseif ($status === 'past_due') {
+            // Do not instantly kill a licence on the first failed renewal. Preserve the
+            // period Paddle says is current; a later canceled event ends entitlement.
+            $license->expires_at = $periodEnd ? Carbon::parse($periodEnd) : ($license->expires_at ?? now()->addDays(7));
+        } elseif (in_array($status, ['canceled', 'paused'], true)) {
+            $license->expires_at = now();
+            $license->revoked_at = now();
+            $license->revoke_reason = $status === 'paused' ? 'Subscription paused' : 'Subscription canceled';
+        }
+
+        $license->save();
+    }
+
+    private function syncPaddleTransaction(array $data): void
+    {
+        $subscriptionID = $this->nullableString($data['subscription_id'] ?? null);
+        $transactionID = (string) ($data['id'] ?? '');
+
+        // Recurring purchases are provisioned from subscription events because those
+        // events contain the authoritative trial/status/current-period state.
+        if ($subscriptionID) {
+            License::where('payment_provider', 'paddle')
+                ->where('external_subscription_id', $subscriptionID)
+                ->whereNull('external_order_id')
+                ->update(['external_order_id' => $transactionID ?: null]);
+
+            return;
+        }
+
+        // Keep support for any future one-time Paddle licence product.
+        $item = $data['items'][0] ?? [];
+        $price = $item['price'] ?? [];
+        $priceID = (string) ($price['id'] ?? $item['price_id'] ?? '');
+        $productID = (string) ($price['product_id'] ?? $item['product_id'] ?? '');
+        $product = $this->mappedProduct('paddle', $priceID, $productID);
+        $custom = is_array($data['custom_data'] ?? null) ? $data['custom_data'] : [];
+        $customer = $this->paddle->customer($this->nullableString($data['customer_id'] ?? null));
+
+        $this->issuer->issue(
+            $product,
+            $this->nullableString($custom['customer_name'] ?? $custom['name'] ?? $customer['name'] ?? null),
+            $this->nullableString($custom['customer_email'] ?? $custom['email'] ?? $customer['email'] ?? null),
+            'paddle',
+            $transactionID,
+            $this->nullableString($data['customer_id'] ?? null),
+            true,
+        );
+    }
+
+    private function provisionLemonSqueezy(array $event): void
+    {
+        $type = (string) ($event['meta']['event_name'] ?? '');
+        $attributes = $event['data']['attributes'] ?? [];
+        $order = (string) ($event['data']['id'] ?? $attributes['order_id'] ?? '');
+
+        if (in_array($type, ['order_refunded', 'subscription_expired'], true)) {
+            License::where('payment_provider', 'lemon-squeezy')
+                ->where('external_order_id', $order)
+                ->whereNull('revoked_at')
+                ->update(['revoked_at' => now(), 'revoke_reason' => 'Payment refunded or subscription expired']);
+
+            return;
+        }
+
+        if (! in_array($type, ['order_created', 'subscription_created'], true)) {
+            return;
+        }
+
+        $product = $this->mappedProduct(
+            'lemon-squeezy',
+            (string) ($attributes['variant_id'] ?? ''),
+            (string) ($attributes['product_id'] ?? ''),
+        );
+
+        $this->issuer->issue(
+            $product,
+            $this->nullableString($attributes['user_name'] ?? null),
+            $this->nullableString($attributes['user_email'] ?? null),
+            'lemon-squeezy',
+            $order,
+            $this->nullableString($attributes['customer_id'] ?? null),
+            true,
+        );
+    }
+
+    private function mappedProduct(string $provider, string $priceID, string $productID): LicenseProduct
+    {
+        // Price IDs are the authoritative mapping because monthly and annual prices
+        // intentionally share the same Paddle product ID.
+        if ($priceID !== '') {
+            $product = LicenseProduct::where('payment_provider', $provider)
+                ->where('external_price_id', $priceID)
+                ->where('active', true)
+                ->first();
+        } else {
+            $product = LicenseProduct::where('payment_provider', $provider)
+                ->where('external_product_id', $productID)
+                ->where('active', true)
+                ->first();
+        }
+
+        if (! $product) {
+            throw new RuntimeException("No active licence product maps to {$provider} price {$priceID} / product {$productID}.");
+        }
+
+        return $product;
+    }
+
+    private function firstRecurringItem(array $items): array
+    {
+        foreach ($items as $item) {
+            if (($item['recurring'] ?? true) === true) {
+                return $item;
+            }
+        }
+
+        return $items[0] ?? [];
+    }
+
+    private function nullableString(mixed $value): ?string
+    {
+        if (! is_scalar($value)) {
+            return null;
+        }
+        $value = trim((string) $value);
+
+        return $value === '' ? null : $value;
+    }
+}
@@ -0,0 +1,10 @@
+<?php
+
+namespace App\Services\Payments;
+
+use Illuminate\Http\Request;
+
+interface WebhookVerifier
+{
+    public function verify(Request $request, string $rawBody): void;
+}
@@ -0,0 +1,18 @@
+#!/usr/bin/env php
+<?php
+
+use Illuminate\Foundation\Application;
+use Symfony\Component\Console\Input\ArgvInput;
+
+define('LARAVEL_START', microtime(true));
+
+// Register the Composer autoloader...
+require __DIR__.'/vendor/autoload.php';
+
+// Bootstrap Laravel and handle the command...
+/** @var Application $app */
+$app = require_once __DIR__.'/bootstrap/app.php';
+
+$status = $app->handleCommand(new ArgvInput);
+
+exit($status);
@@ -0,0 +1,22 @@
+<?php
+
+use Illuminate\Foundation\Application;
+use Illuminate\Foundation\Configuration\Exceptions;
+use Illuminate\Foundation\Configuration\Middleware;
+use Illuminate\Http\Request;
+
+return Application::configure(basePath: dirname(__DIR__))
+    ->withRouting(
+        web: __DIR__.'/../routes/web.php',
+        api: __DIR__.'/../routes/api.php',
+        commands: __DIR__.'/../routes/console.php',
+        health: '/up',
+    )
+    ->withMiddleware(function (Middleware $middleware): void {
+        //
+    })
+    ->withExceptions(function (Exceptions $exceptions): void {
+        $exceptions->shouldRenderJsonWhen(
+            fn (Request $request) => $request->is('api/*') || $request->expectsJson(),
+        );
+    })->create();
@@ -0,0 +1,2 @@
+*
+!.gitignore
@@ -0,0 +1,7 @@
+<?php
+
+use App\Providers\SonarDeskLicensingServiceProvider;
+
+return [
+    SonarDeskLicensingServiceProvider::class,
+];
@@ -0,0 +1,88 @@
+{
+    "schema": "https://getcomposer.org/schema.json",
+    "name": "laravel/laravel",
+    "type": "project",
+    "description": "The skeleton application for the Laravel framework.",
+    "keywords": ["laravel", "framework"],
+    "license": "MIT",
+    "require": {
+        "php": "^8.3",
+        "deployer/deployer": "^8.0",
+        "laravel/framework": "^13.17",
+        "laravel/tinker": "^3.0",
+        "predis/predis": "^3.6"
+    },
+    "require-dev": {
+        "fakerphp/faker": "^1.23",
+        "laravel/pail": "^1.2.5",
+        "laravel/pao": "^1.0.6",
+        "laravel/pint": "^1.27",
+        "mockery/mockery": "^1.6",
+        "nunomaduro/collision": "^8.6",
+        "phpunit/phpunit": "^12.5.12"
+    },
+    "autoload": {
+        "psr-4": {
+            "App\\": "app/",
+            "Database\\Factories\\": "database/factories/",
+            "Database\\Seeders\\": "database/seeders/"
+        }
+    },
+    "autoload-dev": {
+        "psr-4": {
+            "Tests\\": "tests/"
+        }
+    },
+    "scripts": {
+        "setup": [
+            "composer install",
+            "@php -r \"file_exists('.env') || copy('.env.example', '.env');\"",
+            "@php artisan key:generate",
+            "@php artisan migrate --force",
+            "npm install --ignore-scripts",
+            "npm run build"
+        ],
+        "dev": [
+            "Composer\\Config::disableProcessTimeout",
+            "@php artisan dev"
+        ],
+        "test": [
+            "@php artisan config:clear --ansi @no_additional_args",
+            "@php artisan test"
+        ],
+        "post-autoload-dump": [
+            "Illuminate\\Foundation\\ComposerScripts::postAutoloadDump",
+            "@php artisan package:discover --ansi"
+        ],
+        "post-update-cmd": [
+            "@php artisan vendor:publish --tag=laravel-assets --ansi --force"
+        ],
+        "post-root-package-install": [
+            "@php -r \"file_exists('.env') || copy('.env.example', '.env');\""
+        ],
+        "post-create-project-cmd": [
+            "@php artisan key:generate --ansi",
+            "@php -r \"file_exists('database/database.sqlite') || touch('database/database.sqlite');\"",
+            "@php artisan migrate --graceful --ansi"
+        ],
+        "pre-package-uninstall": [
+            "Illuminate\\Foundation\\ComposerScripts::prePackageUninstall"
+        ]
+    },
+    "extra": {
+        "laravel": {
+            "dont-discover": []
+        }
+    },
+    "config": {
+        "optimize-autoloader": true,
+        "preferred-install": "dist",
+        "sort-packages": true,
+        "allow-plugins": {
+            "pestphp/pest-plugin": true,
+            "php-http/discovery": true
+        }
+    },
+    "minimum-stability": "stable",
+    "prefer-stable": true
+}
@@ -0,0 +1,46 @@
+<?php
+
+return [
+    'product_code' => env('SONARDESK_PRODUCT_CODE', 'sonardesk'),
+    'private_key_path' => env('SONARDESK_LICENSE_PRIVATE_KEY_PATH'),
+    'public_key' => env('SONARDESK_LICENSE_PUBLIC_KEY'),
+    'default_edition' => env('SONARDESK_DEFAULT_EDITION', 'Professional'),
+    'default_max_major_version' => (int) env('SONARDESK_DEFAULT_MAX_MAJOR_VERSION', 1),
+    'activation_rate_limit' => env('SONARDESK_ACTIVATION_RATE_LIMIT', '12,1'),
+    'purchase_url' => env('SONARDESK_PURCHASE_URL'),
+    'portal_url' => env('SONARDESK_PORTAL_URL'),
+    'support_url' => env('SONARDESK_SUPPORT_URL'),
+
+    'legal' => [
+        'controller_name' => env('SONARDESK_LEGAL_NAME', 'SonarDesk'),
+        'privacy_email' => env('SONARDESK_PRIVACY_EMAIL', env('MAIL_FROM_ADDRESS')),
+        'support_email' => env('SONARDESK_SUPPORT_EMAIL', env('MAIL_FROM_ADDRESS')),
+        'country' => env('SONARDESK_LEGAL_COUNTRY', 'United Kingdom'),
+    ],
+    'privacy' => [
+        'policy_version' => env('SONARDESK_PRIVACY_VERSION', '2026-09-09'),
+        'cookie_version' => env('SONARDESK_COOKIE_VERSION', '1'),
+        'support_retention_days' => (int) env('SONARDESK_SUPPORT_RETENTION_DAYS', 730),
+    ],
+    'support' => [
+        'alert_emails' => array_values(array_filter(array_map('trim', explode(',', (string) env('SONARDESK_SUPPORT_ALERT_EMAILS', ''))))),
+        'notify_admin_users' => filter_var(env('SONARDESK_SUPPORT_NOTIFY_ADMINS', true), FILTER_VALIDATE_BOOL),
+    ],
+    'paddle' => [
+        'api_key' => env('PADDLE_API_KEY'),
+        'client_side_token' => env('PADDLE_CLIENT_SIDE_TOKEN'),
+        'environment' => env('PADDLE_ENVIRONMENT', env('APP_ENV') === 'production' ? 'production' : 'sandbox'),
+        'api_url' => env('PADDLE_API_URL', env('APP_ENV') === 'production' ? 'https://api.paddle.com' : 'https://sandbox-api.paddle.com'),
+        'webhook_secret' => env('PADDLE_WEBHOOK_SECRET'),
+        'timestamp_tolerance' => (int) env('PADDLE_WEBHOOK_TOLERANCE', 300),
+        'personal_product_id' => env('PADDLE_PERSONAL_PRODUCT_ID'),
+        'personal_monthly_price_id' => env('PADDLE_PERSONAL_MONTHLY_PRICE_ID'),
+        'personal_annual_price_id' => env('PADDLE_PERSONAL_ANNUAL_PRICE_ID'),
+        'professional_product_id' => env('PADDLE_PROFESSIONAL_PRODUCT_ID'),
+        'professional_monthly_price_id' => env('PADDLE_PROFESSIONAL_MONTHLY_PRICE_ID'),
+        'professional_annual_price_id' => env('PADDLE_PROFESSIONAL_ANNUAL_PRICE_ID'),
+    ],
+    'lemon_squeezy' => [
+        'webhook_secret' => env('LEMON_SQUEEZY_WEBHOOK_SECRET'),
+    ],
+];
@@ -0,0 +1,31 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::create('sessions', function (Blueprint $table) {
+            $table->string('id')->primary();
+            $table->foreignId('user_id')->nullable()->index();
+            $table->string('ip_address', 45)->nullable();
+            $table->text('user_agent')->nullable();
+            $table->longText('payload');
+            $table->integer('last_activity')->index();
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::dropIfExists('sessions');
+    }
+};
@@ -0,0 +1,92 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::create('license_products', function (Blueprint $table) {
+            $table->id();
+            $table->string('code')->unique();
+            $table->string('name');
+            $table->string('edition')->default('Professional');
+            $table->unsignedInteger('activation_limit')->default(1);
+            $table->unsignedInteger('max_major_version')->nullable();
+            $table->string('payment_provider')->nullable();
+            $table->string('external_product_id')->nullable();
+            $table->string('external_price_id')->nullable();
+            $table->boolean('active')->default(true);
+            $table->timestamps();
+            $table->unique(['payment_provider', 'external_price_id']);
+        });
+
+        Schema::create('licenses', function (Blueprint $table) {
+            $table->uuid('id')->primary();
+            $table->foreignId('license_product_id')->constrained('license_products');
+            $table->string('license_key_hash', 64)->unique();
+            $table->string('license_key_last4', 4);
+            $table->string('customer_name')->nullable();
+            $table->string('customer_email')->nullable()->index();
+            $table->string('edition');
+            $table->unsignedInteger('activation_limit');
+            $table->unsignedInteger('max_major_version')->nullable();
+            $table->timestamp('expires_at')->nullable();
+            $table->timestamp('revoked_at')->nullable();
+            $table->string('revoke_reason')->nullable();
+            $table->string('payment_provider')->nullable();
+            $table->string('external_order_id')->nullable();
+            $table->string('external_customer_id')->nullable();
+            $table->timestamps();
+            $table->unique(['payment_provider', 'external_order_id']);
+        });
+
+        Schema::create('license_delivery_outbox', function (Blueprint $table) {
+            $table->id();
+            $table->uuid('license_id')->unique();
+            $table->text('encrypted_license_key');
+            $table->string('recipient_email')->nullable();
+            $table->timestamp('delivered_at')->nullable();
+            $table->timestamps();
+            $table->foreign('license_id')->references('id')->on('licenses')->cascadeOnDelete();
+        });
+
+        Schema::create('license_activations', function (Blueprint $table) {
+            $table->id();
+            $table->uuid('license_id');
+            $table->uuid('installation_id');
+            $table->string('platform', 32)->nullable();
+            $table->string('app_version', 32)->nullable();
+            $table->timestamp('activated_at');
+            $table->timestamp('last_seen_at')->nullable();
+            $table->timestamp('deactivated_at')->nullable();
+            $table->foreign('license_id')->references('id')->on('licenses')->cascadeOnDelete();
+            $table->unique(['license_id', 'installation_id']);
+            $table->index(['license_id', 'deactivated_at']);
+        });
+
+        Schema::create('license_webhook_events', function (Blueprint $table) {
+            $table->id();
+            $table->string('provider');
+            $table->string('external_event_id');
+            $table->string('event_type');
+            $table->string('payload_sha256', 64);
+            $table->json('payload');
+            $table->timestamp('processed_at')->nullable();
+            $table->text('processing_error')->nullable();
+            $table->timestamps();
+            $table->unique(['provider', 'external_event_id']);
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::dropIfExists('license_webhook_events');
+        Schema::dropIfExists('license_activations');
+        Schema::dropIfExists('license_delivery_outbox');
+        Schema::dropIfExists('licenses');
+        Schema::dropIfExists('license_products');
+    }
+};
@@ -0,0 +1,35 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::create('cache', function (Blueprint $table) {
+            $table->string('key')->primary();
+            $table->mediumText('value');
+            $table->bigInteger('expiration')->index();
+        });
+
+        Schema::create('cache_locks', function (Blueprint $table) {
+            $table->string('key')->primary();
+            $table->string('owner');
+            $table->bigInteger('expiration')->index();
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::dropIfExists('cache');
+        Schema::dropIfExists('cache_locks');
+    }
+};
@@ -0,0 +1,37 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        if (! Schema::hasTable('users')) {
+            Schema::create('users', function (Blueprint $table): void {
+                $table->id();
+                $table->string('name');
+                $table->string('email')->unique();
+                $table->timestamp('email_verified_at')->nullable();
+                $table->string('password');
+                $table->rememberToken();
+                $table->timestamps();
+            });
+        }
+
+        if (! Schema::hasTable('password_reset_tokens')) {
+            Schema::create('password_reset_tokens', function (Blueprint $table): void {
+                $table->string('email')->primary();
+                $table->string('token');
+                $table->timestamp('created_at')->nullable();
+            });
+        }
+    }
+
+    public function down(): void
+    {
+        Schema::dropIfExists('password_reset_tokens');
+        Schema::dropIfExists('users');
+    }
+};
@@ -0,0 +1,30 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        if (Schema::hasTable('users') && ! Schema::hasColumn('users', 'is_admin')) {
+            Schema::table('users', fn (Blueprint $table) => $table->boolean('is_admin')->default(false)->index());
+        }
+
+        if (Schema::hasTable('license_activations') && ! Schema::hasColumn('license_activations', 'installation_name')) {
+            Schema::table('license_activations', fn (Blueprint $table) => $table->string('installation_name')->nullable()->after('installation_id'));
+        }
+    }
+
+    public function down(): void
+    {
+        if (Schema::hasTable('license_activations') && Schema::hasColumn('license_activations', 'installation_name')) {
+            Schema::table('license_activations', fn (Blueprint $table) => $table->dropColumn('installation_name'));
+        }
+
+        if (Schema::hasTable('users') && Schema::hasColumn('users', 'is_admin')) {
+            Schema::table('users', fn (Blueprint $table) => $table->dropColumn('is_admin'));
+        }
+    }
+};
@@ -0,0 +1,34 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('licenses', function (Blueprint $table) {
+            $table->string('external_subscription_id')->nullable()->after('external_customer_id');
+            $table->string('external_price_id')->nullable()->after('external_subscription_id');
+            $table->string('subscription_status')->nullable()->after('external_price_id');
+            $table->timestamp('current_period_ends_at')->nullable()->after('subscription_status');
+            $table->timestamp('cancel_scheduled_at')->nullable()->after('current_period_ends_at');
+            $table->unique(['payment_provider', 'external_subscription_id']);
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('licenses', function (Blueprint $table) {
+            $table->dropUnique(['payment_provider', 'external_subscription_id']);
+            $table->dropColumn([
+                'external_subscription_id',
+                'external_price_id',
+                'subscription_status',
+                'current_period_ends_at',
+                'cancel_scheduled_at',
+            ]);
+        });
+    }
+};
@@ -0,0 +1,47 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        if (! Schema::hasTable('support_tickets')) {
+            Schema::create('support_tickets', function (Blueprint $table): void {
+                $table->id();
+                $table->foreignId('user_id')->nullable()->constrained()->nullOnDelete();
+                $table->foreignId('assigned_to')->nullable()->constrained('users')->nullOnDelete();
+                $table->string('reference', 24)->unique();
+                $table->string('name', 120);
+                $table->string('email', 254)->index();
+                $table->string('category', 40)->default('general');
+                $table->string('subject', 180);
+                $table->text('message');
+                $table->string('status', 20)->default('new')->index();
+                $table->string('priority', 20)->default('normal');
+                $table->timestamp('privacy_notice_accepted_at');
+                $table->timestamp('resolved_at')->nullable()->index();
+                $table->timestamps();
+            });
+        }
+
+        if (! Schema::hasTable('notifications')) {
+            Schema::create('notifications', function (Blueprint $table): void {
+                $table->uuid('id')->primary();
+                $table->string('type');
+                $table->morphs('notifiable');
+                $table->text('data');
+                $table->timestamp('read_at')->nullable();
+                $table->timestamps();
+            });
+        }
+    }
+
+    public function down(): void
+    {
+        Schema::dropIfExists('support_tickets');
+        Schema::dropIfExists('notifications');
+    }
+};
@@ -0,0 +1,25 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration {
+    public function up(): void
+    {
+        Schema::create('cms_pages', function (Blueprint $table): void {
+            $table->id();
+            $table->string('title');
+            $table->string('slug')->unique();
+            $table->text('excerpt')->nullable();
+            $table->longText('body');
+            $table->string('meta_title')->nullable();
+            $table->string('meta_description', 320)->nullable();
+            $table->boolean('is_published')->default(false)->index();
+            $table->timestamp('published_at')->nullable()->index();
+            $table->timestamps();
+        });
+    }
+
+    public function down(): void { Schema::dropIfExists('cms_pages'); }
+};
@@ -0,0 +1,29 @@
+<?php
+
+namespace Database\Seeders;
+
+use App\Models\LicenseProduct;
+use Illuminate\Database\Seeder;
+
+class PaddleCatalogSeeder extends Seeder
+{
+    public function run(): void
+    {
+        $products = [
+            ['code' => 'personal-monthly', 'name' => 'SonarDesk Personal Monthly', 'edition' => 'Personal', 'activation_limit' => 1, 'external_product_id' => config('sonardesk.paddle.personal_product_id'), 'external_price_id' => config('sonardesk.paddle.personal_monthly_price_id')],
+            ['code' => 'personal-annual', 'name' => 'SonarDesk Personal Annual', 'edition' => 'Personal', 'activation_limit' => 1, 'external_product_id' => config('sonardesk.paddle.personal_product_id'), 'external_price_id' => config('sonardesk.paddle.personal_annual_price_id')],
+            ['code' => 'professional-monthly', 'name' => 'SonarDesk Professional Monthly', 'edition' => 'Professional', 'activation_limit' => 3, 'external_product_id' => config('sonardesk.paddle.professional_product_id'), 'external_price_id' => config('sonardesk.paddle.professional_monthly_price_id')],
+            ['code' => 'professional-annual', 'name' => 'SonarDesk Professional Annual', 'edition' => 'Professional', 'activation_limit' => 3, 'external_product_id' => config('sonardesk.paddle.professional_product_id'), 'external_price_id' => config('sonardesk.paddle.professional_annual_price_id')],
+        ];
+
+        foreach ($products as $data) {
+            if (! $data['external_product_id'] || ! $data['external_price_id']) {
+                continue;
+            }
+            LicenseProduct::updateOrCreate(
+                ['code' => $data['code']],
+                $data + ['payment_provider' => 'paddle', 'max_major_version' => config('sonardesk.default_max_major_version'), 'active' => true]
+            );
+        }
+    }
+}
@@ -0,0 +1,61 @@
+<?php
+
+namespace Deployer;
+
+require 'recipe/laravel.php';
+
+// System Config
+set('writable_use_sudo', true);
+set('clear_use_sudo', true);
+set('cleanup_use_sudo', true);
+set('keep_releases', 1);
+set('repository', 'git@git.absdev.net:mag/SonarDesk.git');
+set('node_version', '22.12.0');
+set('allow_anonymous_stats', false);
+
+add('shared_files', ['.env']);
+add('shared_dirs', ['storage']);
+add('writable_dirs', ['storage', 'bootstrap/cache']);
+
+// Host Definitions
+host('main')
+    ->set('hostname', 'sonardesk.absdev.net')
+    ->set('remote_user', 'mag')
+    ->set('branch', 'main')
+    ->set('deploy_path', '/var/www/sonardesk');
+
+host('stage')
+    ->set('hostname', 'sonardesk.absdev.net')
+    ->set('remote_user', 'mag')
+    ->set('branch', 'stage')
+    ->set('deploy_path', '/var/www/sonardesk_dev');
+
+task('build', function (): void {
+    run('export NVM_DIR="$HOME/.nvm" && [ -s "$NVM_DIR/nvm.sh" ] && . "$NVM_DIR/nvm.sh" && nvm use {{node_version}} && cd {{release_path}} && npm ci --no-audit --no-fund');
+    run('export NVM_DIR="$HOME/.nvm" && [ -s "$NVM_DIR/nvm.sh" ] && . "$NVM_DIR/nvm.sh" && nvm use {{node_version}} && cd {{release_path}} && npm run build');
+});
+task('queue:restart', function (): void {
+    run('cd {{release_path}} && php artisan queue:restart');
+});
+task('deploy:write_revision_file', function (): void {
+    run('cd {{release_path}} && echo "{{branch}}" > BRANCH');
+    run('cd {{release_path}} && date -u +"%Y-%m-%dT%H:%M:%SZ" > DEPLOYED_AT');
+});
+task('artisan:clear', function (): void {
+    run('cd {{release_path}} && php artisan view:clear');
+    run('cd {{release_path}} && php artisan optimize:clear');
+    run('cd {{release_path}} && php artisan config:clear');
+    run('cd {{release_path}} && php artisan route:clear');
+});
+task('services:restart', function (): void {
+    run('sudo -n nginx -t');
+    run('sudo -n systemctl reload nginx');
+    run('sudo -n systemctl restart php8.3-fpm');
+});
+
+after('deploy:update_code', 'deploy:write_revision_file');
+after('deploy:vendors', 'build');
+after('deploy:symlink', 'artisan:clear');
+after('deploy:symlink', 'queue:restart');
+after('deploy:failed', 'deploy:unlock');
+after('deploy:symlink', 'services:restart');
@@ -0,0 +1,71 @@
+# Paddle subscription integration
+
+## Sandbox configuration
+
+Keep the Paddle API key and webhook secret server-side only. Do not put either value in the macOS application or commit them to Git.
+
+Required environment variables:
+
+```dotenv
+PADDLE_API_KEY=pdl_sdbx_apikey_...
+PADDLE_API_URL=https://sandbox-api.paddle.com
+PADDLE_WEBHOOK_SECRET=...
+
+PADDLE_PERSONAL_PRODUCT_ID=pro_01m22q4c3vt7yvtv3h3zw1jbn0
+PADDLE_PERSONAL_MONTHLY_PRICE_ID=pri_01m22q4cjx177krcpvdph7e2vy
+PADDLE_PERSONAL_ANNUAL_PRICE_ID=pri_01m22q4cs9sr5gshxp6j56nvmh
+PADDLE_PROFESSIONAL_PRODUCT_ID=pro_01m22q4d0s6y1557wsq9s7xw8n
+PADDLE_PROFESSIONAL_MONTHLY_PRICE_ID=pri_01m22q4d6h1yvr1frawtx51gy8
+PADDLE_PROFESSIONAL_ANNUAL_PRICE_ID=pri_01m22q4dcndcdbzc20txadaz52
+```
+
+Then run:
+
+```bash
+php artisan migrate
+php artisan db:seed --class=Database\\Seeders\\PaddleCatalogSeeder
+php artisan config:clear
+```
+
+The seeder maps the four Paddle price IDs to licensing entitlements. Personal permits one active Mac; Professional permits three.
+
+## Paddle notification destination
+
+Configure the sandbox notification destination to POST to:
+
+`https://YOUR-HOST/api/v1/webhooks/paddle`
+
+Copy the destination endpoint secret into `PADDLE_WEBHOOK_SECRET`.
+
+Subscribe to at least:
+
+- `subscription.created`
+- `subscription.updated`
+- `subscription.activated`
+- `subscription.trialing`
+- `subscription.canceled`
+- `subscription.paused`
+- `subscription.resumed`
+- `subscription.past_due`
+- `transaction.completed`
+- `transaction.refunded`
+
+## Entitlement behavior
+
+- Trialing and active subscriptions are usable.
+- A scheduled end-of-period cancellation stays usable until Paddle changes the subscription to canceled.
+- Upgrades/downgrades update the entitlement on the existing licence key.
+- Canceled or paused subscriptions revoke the licence.
+- Past-due subscriptions retain access through Paddle's current billing period rather than being revoked on the first failed payment.
+- Paddle customer details are fetched server-side when the webhook does not carry customer email/name in custom data.
+
+## Important
+
+The API key is required only on the licensing server. Use a sandbox key with the sandbox API URL. Live Paddle products/prices have different IDs and should be configured separately when moving to production.
+
+
+## Hosted sandbox checkout
+
+The licensing site exposes `/buy`, which initializes Paddle.js with `PADDLE_CLIENT_SIDE_TOKEN` and opens an overlay checkout for the four configured price IDs. Set `PADDLE_ENVIRONMENT=sandbox` while testing and use a `test_...` client-side token. The token is intentionally browser-visible; never use `PADDLE_API_KEY` in frontend code.
+
+After a subscription webhook provisions a licence, the webhook controller makes a best-effort attempt to deliver pending licence keys by email. Delivery failures do not roll back the verified Paddle event; the encrypted outbox remains available for portal resend.
@@ -0,0 +1,24 @@
+# SonarDesk launch frontend
+
+The public `/` page is now a product-launch landing page using the same shared Laravel layout as checkout, support, authentication and the licence portal.
+
+## Favicon/device assets
+
+The website uses the existing SonarDesk app icon as the web brand source and includes:
+
+- multi-resolution `public/favicon.ico`
+- 16x16, 32x32 and 48x48 browser favicons
+- 180x180 Apple touch icon
+- 192x192 and 512x512 Android/PWA icons
+- Windows 150x150 tile icon and `browserconfig.xml`
+- Safari pinned-tab mask icon
+- `site.webmanifest`
+- Open Graph/Twitter image metadata
+
+The shared `resources/views/layouts/app.blade.php` loads these assets on every website page.
+
+## Launch page
+
+`resources/views/portal/welcome.blade.php` contains the public product page: hero, native app preview, features, workflow, security positioning, Personal/Professional plan summary and trial calls-to-action.
+
+Non-production environments automatically emit `noindex,nofollow`; production emits normal index/follow metadata.
@@ -0,0 +1,7 @@
+PADDLE_PERSONAL_PRODUCT_ID=pro_01m22q4c3vt7yvtv3h3zw1jbn0
+PADDLE_PERSONAL_MONTHLY_PRICE_ID=pri_01m22q4cjx177krcpvdph7e2vy
+PADDLE_PERSONAL_ANNUAL_PRICE_ID=pri_01m22q4cs9sr5gshxp6j56nvmh
+
+PADDLE_PROFESSIONAL_PRODUCT_ID=pro_01m22q4d0s6y1557wsq9s7xw8n
+PADDLE_PROFESSIONAL_MONTHLY_PRICE_ID=pri_01m22q4d6h1yvr1frawtx51gy8
+PADDLE_PROFESSIONAL_ANNUAL_PRICE_ID=pri_01m22q4dcndcdbzc20txadaz52
@@ -0,0 +1,19 @@
+{
+    "$schema": "https://www.schemastore.org/package.json",
+    "private": true,
+    "type": "module",
+    "scripts": {
+        "build": "vite build",
+        "dev": "vite"
+    },
+    "devDependencies": {
+        "@tailwindcss/vite": "^4.0.0",
+        "concurrently": "^10.0.3",
+        "laravel-vite-plugin": "^3.1",
+        "tailwindcss": "^4.0.0",
+        "vite": "^8.0.0"
+    },
+    "optionalDependencies": {
+        "@laravel/multiplex": "^0.4.1"
+    }
+}
@@ -0,0 +1,36 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<phpunit xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:noNamespaceSchemaLocation="vendor/phpunit/phpunit/phpunit.xsd"
+         bootstrap="vendor/autoload.php"
+         colors="true"
+>
+    <testsuites>
+        <testsuite name="Unit">
+            <directory>tests/Unit</directory>
+        </testsuite>
+        <testsuite name="Feature">
+            <directory>tests/Feature</directory>
+        </testsuite>
+    </testsuites>
+    <source>
+        <include>
+            <directory>app</directory>
+        </include>
+    </source>
+    <php>
+        <env name="APP_ENV" value="testing"/>
+        <env name="APP_MAINTENANCE_DRIVER" value="file"/>
+        <env name="BCRYPT_ROUNDS" value="4"/>
+        <env name="BROADCAST_CONNECTION" value="null"/>
+        <env name="CACHE_STORE" value="array"/>
+        <env name="DB_CONNECTION" value="sqlite"/>
+        <env name="DB_DATABASE" value=":memory:"/>
+        <env name="DB_URL" value=""/>
+        <env name="MAIL_MAILER" value="array"/>
+        <env name="QUEUE_CONNECTION" value="sync"/>
+        <env name="SESSION_DRIVER" value="array"/>
+        <env name="PULSE_ENABLED" value="false"/>
+        <env name="TELESCOPE_ENABLED" value="false"/>
+        <env name="NIGHTWATCH_ENABLED" value="false"/>
+    </php>
+</phpunit>
@@ -0,0 +1,25 @@
+<IfModule mod_rewrite.c>
+    <IfModule mod_negotiation.c>
+        Options -MultiViews -Indexes
+    </IfModule>
+
+    RewriteEngine On
+
+    # Handle Authorization Header
+    RewriteCond %{HTTP:Authorization} .
+    RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
+
+    # Handle X-XSRF-Token Header
+    RewriteCond %{HTTP:x-xsrf-token} .
+    RewriteRule .* - [E=HTTP_X_XSRF_TOKEN:%{HTTP:X-XSRF-Token}]
+
+    # Redirect Trailing Slashes If Not A Folder...
+    RewriteCond %{REQUEST_FILENAME} !-d
+    RewriteCond %{REQUEST_URI} (.+)/$
+    RewriteRule ^ %1 [L,R=301]
+
+    # Send Requests To Front Controller...
+    RewriteCond %{REQUEST_FILENAME} !-d
+    RewriteCond %{REQUEST_FILENAME} !-f
+    RewriteRule ^ index.php [L]
+</IfModule>
@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="utf-8"?>
+<browserconfig>
+  <msapplication>
+    <tile>
+      <square150x150logo src="/icons/mstile-150x150.png"/>
+      <TileColor>#2563eb</TileColor>
+    </tile>
+  </msapplication>
+</browserconfig>
@@ -0,0 +1,3 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512">
+  <path fill="#000" d="M256 89c85 0 154 60 167 139l-46 8c-9-56-60-100-121-100-45 0-85 24-106 60l41 15-83 36-33-85 31 12C135 123 191 89 256 89Zm0 334c-85 0-154-60-167-139l46-8c9 56 60 100 121 100 45 0 85-24 106-60l-41-15 83-36 33 85-31-12c-29 51-85 85-150 85Zm-69-192h138v25H187v-25Zm0 55h138v25H187v-25Z"/>
+</svg>
@@ -0,0 +1,20 @@
+<?php
+
+use Illuminate\Foundation\Application;
+use Illuminate\Http\Request;
+
+define('LARAVEL_START', microtime(true));
+
+// Determine if the application is in maintenance mode...
+if (file_exists($maintenance = __DIR__.'/../storage/framework/maintenance.php')) {
+    require $maintenance;
+}
+
+// Register the Composer autoloader...
+require __DIR__.'/../vendor/autoload.php';
+
+// Bootstrap Laravel and handle the request...
+/** @var Application $app */
+$app = require_once __DIR__.'/../bootstrap/app.php';
+
+$app->handleRequest(Request::capture());
@@ -0,0 +1,2 @@
+User-agent: *
+Disallow:
@@ -0,0 +1,13 @@
+{
+  "name": "SonarDesk",
+  "short_name": "SonarDesk",
+  "description": "Native SonarQube monitoring for macOS.",
+  "start_url": "/",
+  "display": "standalone",
+  "background_color": "#f7f9fc",
+  "theme_color": "#0b1220",
+  "icons": [
+    {"src": "/icons/android-chrome-192x192.png", "sizes": "192x192", "type": "image/png"},
+    {"src": "/icons/android-chrome-512x512.png", "sizes": "512x512", "type": "image/png"}
+  ]
+}
@@ -0,0 +1,9 @@
+@import 'tailwindcss';
+
+@source '../../vendor/laravel/framework/src/Illuminate/Pagination/resources/views/*.blade.php';
+@source '../../storage/framework/views/*.php';
+
+@theme {
+    --font-sans: 'Instrument Sans', ui-sans-serif, system-ui, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji',
+        'Segoe UI Symbol', 'Noto Color Emoji';
+}
@@ -0,0 +1 @@
+//
@@ -0,0 +1,14 @@
+@extends('layouts.app')
+@section('content')
+<section class="portal-header"><div><span class="eyebrow">CMS</span><h1>{{ $page->exists ? 'Edit page' : 'New page' }}</h1></div><a class="btn btn-secondary" href="{{ route('admin.cms.index') }}">Back to pages</a></section>
+<div class="panel"><form method="post" action="{{ $page->exists ? route('admin.cms.update',$page) : route('admin.cms.store') }}">@csrf @if($page->exists) @method('PUT') @endif
+<label>Title<input name="title" value="{{ old('title',$page->title) }}" required maxlength="160"></label>
+<label>Slug<input name="slug" value="{{ old('slug',$page->slug) }}" placeholder="generated-from-title" maxlength="180"></label>
+<label>Excerpt<textarea name="excerpt" rows="3" maxlength="1000">{{ old('excerpt',$page->excerpt) }}</textarea></label>
+<label>Body<textarea name="body" rows="18" required>{{ old('body',$page->body) }}</textarea><small>Plain text is rendered safely with paragraphs and line breaks.</small></label>
+<div class="form-grid two"><label>SEO title<input name="meta_title" value="{{ old('meta_title',$page->meta_title) }}" maxlength="160"></label><label>SEO description<textarea name="meta_description" rows="3" maxlength="320">{{ old('meta_description',$page->meta_description) }}</textarea></label></div>
+<label class="consent-check"><input type="checkbox" name="is_published" value="1" @checked(old('is_published',$page->is_published))><span>Published</span></label>
+<div class="support-actions"><button type="submit">Save page</button>@if($page->exists && $page->is_published)<a class="btn btn-secondary" target="_blank" href="{{ route('cms.show',$page->slug) }}">View page</a>@endif</div>
+</form></div>
+@if($page->exists)<form method="post" action="{{ route('admin.cms.destroy',$page) }}" style="margin-top:16px" onsubmit="return confirm('Delete this page?')">@csrf @method('DELETE')<button class="danger-outline">Delete page</button></form>@endif
+@endsection
@@ -0,0 +1,9 @@
+@extends('layouts.app')
+@section('content')
+<section class="portal-header"><div><span class="eyebrow">CMS</span><h1>Content pages</h1><p class="lead compact">Manage SonarDesk website content.</p></div><a class="btn" href="{{ route('admin.cms.create') }}">New page</a></section>
+<div class="panel"><div class="admin-ticket-list">
+@forelse($pages as $page)
+<a class="admin-ticket-row" href="{{ route('admin.cms.edit', $page) }}"><div><strong>{{ $page->title }}</strong><small>/pages/{{ $page->slug }}</small></div><span class="ticket-status {{ $page->is_published ? 'status-open' : '' }}">{{ $page->is_published ? 'Published' : 'Draft' }}</span><time>{{ $page->updated_at->diffForHumans() }}</time><span>›</span></a>
+@empty <p class="muted">No CMS pages yet.</p> @endforelse
+</div>{{ $pages->links() }}</div>
+@endsection
@@ -0,0 +1,6 @@
+@extends('layouts.app')
+@section('content')
+<section class="portal-header"><div><span class="eyebrow">Admin</span><h1>Licensing administration</h1><p class="lead compact">Manage licences, activations and customer support.</p></div></section>
+<div class="grid"><div class="card"><strong>{{ $licenseCount }}</strong><p>Licences</p></div><div class="card"><strong>{{ $activeCount }}</strong><p>Not revoked</p></div><div class="card"><strong>{{ $activationCount }}</strong><p>Active installations</p></div><div class="card"><strong>{{ $userCount }}</strong><p>Portal users</p></div></div>
+<div style="display:flex;gap:10px;flex-wrap:wrap;margin-top:18px"><a class="btn" href="{{ route('admin.licenses') }}">Manage licences</a><a class="btn btn-secondary" href="{{ route('admin.cms.index') }}">Manage content</a><a class="btn btn-secondary" href="{{ route('admin.support.index') }}">Support inbox</a></div>
+@endsection
@@ -0,0 +1 @@
+@extends('layouts.app') @section('content')<div class="card"><h1>Licence •••• {{ $license->license_key_last4 }}</h1><p>{{ $license->customer_name }} · {{ $license->customer_email }}</p><p>{{ $license->edition }} · {{ $license->activation_limit }} seats</p>@if($license->revoked_at)<form method="post" action="{{ route('admin.restore',$license) }}">@csrf<button>Restore licence</button></form>@else<form method="post" action="{{ route('admin.revoke',$license) }}">@csrf<label>Reason</label><input name="reason"><button class="danger">Revoke licence</button></form>@endif</div><div class="card"><h2>Activations</h2><table><tr><th>ID</th><th>Platform</th><th>Version</th><th>Status</th></tr>@foreach($license->activations as $a)<tr><td>{{ $a->installation_name ?: $a->installation_id }}</td><td>{{ $a->platform }}</td><td>{{ $a->app_version }}</td><td>{{ $a->deactivated_at ? 'Released':'Active' }}</td></tr>@endforeach</table></div>@endsection
@@ -0,0 +1 @@
+@extends('layouts.app') @section('content')<h1>Licences</h1><form><input name="q" value="{{ request('q') }}" placeholder="Search email, name or last 4"><button>Search</button></form><div class="card"><table><tr><th>Customer</th><th>Edition</th><th>Key</th><th>Status</th></tr>@foreach($licenses as $l)<tr><td><a href="{{ route('admin.license',$l) }}">{{ $l->customer_email ?: 'Manual' }}</a></td><td>{{ $l->edition }}</td><td>•••• {{ $l->license_key_last4 }}</td><td>{{ $l->revoked_at ? 'Revoked':'Active' }}</td></tr>@endforeach</table>{{ $licenses->links() }}</div>@endsection
@@ -0,0 +1,24 @@
+@extends('layouts.app', ['title' => 'Support Inbox — SonarDesk'])
+@section('content')
+<section class="portal-header"><div><span class="eyebrow">Admin</span><h1>Support inbox</h1><p class="lead compact">Customer, licence, billing and privacy requests.</p></div></section>
+<form method="get" class="filter-bar">
+    <label for="status">Status</label>
+    <select id="status" name="status" onchange="this.form.submit()">
+        <option value="">All</option>
+        @foreach(['new','open','waiting','resolved','closed'] as $status)<option value="{{ $status }}" @selected(request('status') === $status)>{{ ucfirst($status) }}</option>@endforeach
+    </select>
+</form>
+<div class="admin-ticket-list">
+@forelse($tickets as $ticket)
+    <a class="admin-ticket-row" href="{{ route('admin.support.show', $ticket) }}">
+        <div><span class="ticket-ref">{{ $ticket->reference }}</span><strong>{{ $ticket->subject }}</strong><small>{{ $ticket->name }} · {{ $ticket->email }}</small></div>
+        <span class="ticket-category">{{ ucfirst($ticket->category) }}</span>
+        <span class="ticket-status status-{{ $ticket->status }}">{{ ucfirst($ticket->status) }}</span>
+        <time>{{ $ticket->created_at->diffForHumans() }}</time>
+    </a>
+@empty
+    <div class="empty-state"><h2>No support requests</h2><p>The support inbox is empty.</p></div>
+@endforelse
+</div>
+{{ $tickets->links() }}
+@endsection
@@ -0,0 +1,14 @@
+@extends('layouts.app', ['title' => $ticket->reference.' — Support'])
+@section('content')
+<a class="back-link" href="{{ route('admin.support.index') }}">← Support inbox</a>
+<section class="ticket-detail-head"><div><span class="ticket-ref">{{ $ticket->reference }}</span><h1>{{ $ticket->subject }}</h1><p>{{ $ticket->name }} · <a href="mailto:{{ $ticket->email }}?subject=Re:%20{{ rawurlencode($ticket->reference.' '.$ticket->subject) }}">{{ $ticket->email }}</a></p></div><span class="ticket-status status-{{ $ticket->status }}">{{ ucfirst($ticket->status) }}</span></section>
+<div class="detail-grid">
+    <article class="panel ticket-message"><h2>Request</h2><div class="ticket-meta"><span>{{ ucfirst($ticket->category) }}</span><span>{{ $ticket->created_at->format('j M Y H:i') }}</span></div><div class="message-body">{!! nl2br(e($ticket->message)) !!}</div><a class="btn btn-primary" href="mailto:{{ $ticket->email }}?subject=Re:%20{{ rawurlencode($ticket->reference.' '.$ticket->subject) }}">Reply by email</a></article>
+    <aside class="panel"><h2>Manage</h2><form method="post" action="{{ route('admin.support.update', $ticket) }}">@csrf @method('PATCH')
+        <label>Status<select name="status">@foreach(['new','open','waiting','resolved','closed'] as $status)<option value="{{ $status }}" @selected($ticket->status === $status)>{{ ucfirst($status) }}</option>@endforeach</select></label>
+        <label>Priority<select name="priority">@foreach(['low','normal','high','urgent'] as $priority)<option value="{{ $priority }}" @selected($ticket->priority === $priority)>{{ ucfirst($priority) }}</option>@endforeach</select></label>
+        <label>Assigned to<select name="assigned_to"><option value="">Unassigned</option>@foreach($admins as $admin)<option value="{{ $admin->id }}" @selected($ticket->assigned_to === $admin->id)>{{ $admin->name }} — {{ $admin->email }}</option>@endforeach</select></label>
+        <button class="full-width">Save changes</button>
+    </form></aside>
+</div>
+@endsection
@@ -0,0 +1 @@
+@extends('layouts.app') @section('content')<div class="card"><h1>Reset password</h1><form method="post" action="{{ route('password.email') }}">@csrf<label>Email</label><input name="email" type="email" required><button>Send reset link</button></form></div>@endsection
@@ -0,0 +1 @@
+@extends('layouts.app') @section('content')<div class="card"><h1>Sign in</h1><form method="post" action="{{ route('login') }}">@csrf<label>Email</label><input name="email" type="email" value="{{ old('email') }}" required autofocus><label>Password</label><input name="password" type="password" required><label><input style="width:auto" type="checkbox" name="remember"> Remember me</label><br><button>Sign in</button> <a href="{{ route('password.request') }}">Forgot password?</a></form></div>@endsection
@@ -0,0 +1 @@
+@extends('layouts.app') @section('content')<div class="card"><h1>Create account</h1><p class="muted">Use the same email address used to purchase SonarDesk.</p><form method="post" action="{{ route('register') }}">@csrf<label>Name</label><input name="name" value="{{ old('name') }}" required><label>Email</label><input name="email" type="email" value="{{ old('email') }}" required><label>Password</label><input name="password" type="password" required><label>Confirm password</label><input name="password_confirmation" type="password" required><button>Create account</button></form></div>@endsection
--- a/Show More
+++ b/Show More
				`@@ -0,0 +1 @@`
				@extends('layouts.app') @section('content')<div class="card"><h1>Licence •••• {{ $license->license_key_last4 }}</h1><p>{{ $license->customer_name }} · {{ $license->customer_email }}</p><p>{{ $license->edition }} · {{ $license->activation_limit }} seats</p>@if($license->revoked_at)<form method="post" action="{{ route('admin.restore',$license) }}">@csrf<button>Restore licence</button></form>@else<form method="post" action="{{ route('admin.revoke',$license) }}">@csrf<label>Reason</label><input name="reason"><button class="danger">Revoke licence</button></form>@endif</div><div class="card"><h2>Activations</h2><table><tr><th>ID</th><th>Platform</th><th>Version</th><th>Status</th></tr>@foreach($license->activations as $a)<tr><td>{{ $a->installation_name ?: $a->installation_id }}</td><td>{{ $a->platform }}</td><td>{{ $a->app_version }}</td><td>{{ $a->deactivated_at ? 'Released':'Active' }}</td></tr>@endforeach</table></div>@endsection
				`@@ -0,0 +1 @@`
				`@extends('layouts.app') @section('content')<div class="card"><h1>Reset password</h1><form method="post" action="{{ route('password.email') }}">@csrf<label>Email</label><input name="email" type="email" required><button>Send reset link</button></form></div>@endsection`