licentivo-launch 0.1.2 → 0.1.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f25a673aa0fa381137469b0364787bf62cf2a08ff5d07056a135d0c06da72dc1
-  data.tar.gz: 173f9331cb936efd93cba33cbfba77810c5d3483e71d9d202af05edbfb98a6af
+  metadata.gz: a541ba332c2a6d9adb50c359917ace42ef33495b30af65407e84a521ea081343
+  data.tar.gz: 868bda7f957341cc376c8b82377d7af7bab54b500c3cc3432fa190dfb2fe9029
 SHA512:
-  metadata.gz: d58be5da9f7c2430b11c09b90ed26fd463a77b9f1e4e07314df71f7918acb3bbcfc8e82df5ee13a72f5d085510c54c01e9285938ed50a917c16453a91d759558
-  data.tar.gz: b120504fc4bbe8de9cea230770d5f398a6ffff5960ed6883d7c962997b713f47d3f270f832ca934e6d2b8639aff637ff681a237a56b534741df06479388dad72
+  metadata.gz: 917ab9655d0e640d9e459d96e262521e4d711bbd62806e58bd521c241aedaefad3356e35d9f81f509b3ebcf15e24465cb7168b390519bd75d84a577b5c3dc205
+  data.tar.gz: 7bbc9bf5c8cb4a59094d44dc07a2a116be40344720ce1787b946ed94945161564fa3a944ec2773fe5ddd72f876ece9aa3ace604678a20964578ae270bcfb3fa8

data/README.md

@@ -1,12 +1,14 @@
-# Launch Ruby 0.1.2
+# Launch Ruby 0.1.3
+
+> Local account-exchange changes are unpublished. Login uses a short-lived identity assertion; Launch calculates purchased dates and Licentivo owns runtime permission. See the repository guide docs/account-purchase-boundary.md.
 
 Ruby 3.1+. Install only the Launch gem matching the platform:
 
 ```sh
-gem install licentivo-launch --version 0.1.2
+gem install licentivo-launch --version 0.1.3
 ```
 
-SDK 0.11.1 Ruby code, its private native core and Windows curl DLL are included. RubyGems resolves the ordinary base64 dependency. The generic source gem builds its own embedded core automatically and needs normal C11/curl/OpenSSL tools for the platform. No official SDK gem or external native-library override is needed.
+SDK 0.11.2 Ruby code, its private native core and Windows curl DLL are included. RubyGems resolves the ordinary base64 dependency. The generic source gem builds its own embedded core automatically and needs normal C11/curl/OpenSSL tools for the platform. No official SDK gem or external native-library override is needed.
 
 ## Direct initialization and manual lifecycle
 
@@ -26,10 +28,20 @@ restore, logout and release_device must handle errors. CancellationToken is coop
 
 Launch automatically supplies the current merchant URL, existing product mapping and signing public keys when you select the software in its integration page. Copy its connection function, or use the values already shown there when writing code manually. Do not ask the integrator to type two internal product IDs. No launch-config.json or product.json file is required. The merchant URL is mandatory; the official licensing origin is fixed inside the package to https://www.licentivo.com.
 
-The connection function initializes an application; it does not authorize business work. Login obtains only the signed-in customer's credential. Restore checks account expiry, identity, product and environment. Put every protected operation inside the feature guard. Do not substitute merchant order state or a locally saved boolean for the SDK's signed checks.
+The connection function creates the account adapter. Login obtains a short-lived identity assertion, which is passed only in memory to the official SDK with the connection and environment. Remembered account records contain public routing context and the Launch account session; they never store the assertion, license key or signed runtime permission. Every protected action still passes the official SDK.
 
-Normal close stops the runtime. Logout clears local account/cache state and follows this package's remote-session contract. Device release is a separate explicit operation, and failure must be reported. Sessions default to memory. Remembered login needs a protected store; never persist merchant passwords. Scope private SDK cache directories by origin, product, environment and account, and exclude them from installers and logs. Session encryption does not encrypt every official SDK device file.
+Normal close preserves remembered login and device binding. Explicit Logout first marks the protected account record as signed out, delegates device logout to the official SDK and stops local use. Until Launch confirms sign-out (HTTP 200 or an already-invalid session via HTTP 401), a protected account logout task is retained. Login, Restore and subsequent Logout retry that task; they never restore it as a login. Process-restart recovery requires a persistent protected Store; MemoryStore lasts only for the current process. ReleaseDevice follows the same flow. Keep the official SDK cache and .logout.json journal intact; that SDK alone manages its device-release tickets.
 
-Only transport failures or HTTP 5xx may attempt an existing cryptographically verified offline grant. Explicit 401/403/404, session/account mismatch, expiration or suspension deny access without offline fallback. Pending retries are finite and honor Retry-After; cancellation and rate limiting never authorize work. First activation and mandatory-online policies retain their network requirements.
+Launch Restore confirms the account online and obtains a new identity assertion. It never selects offline permission during a Launch outage. Applications requiring offline startup use the official SDK recovery contract directly. The official SDK alone owns signed permission, device credentials, offline expiry and logout recovery.
 
 Manual development is supported without AI. The combined source bundle includes docs/manual-integration.md with all nine language flows, secure storage, error handling and acceptance procedures. Local package/runtime checks are distinct from external payment and licensing acceptance. Check the current publication status at https://github.com/spf86/licentivo-launch-sdk/blob/main/docs/registry-status.json before using public registry installation commands.
+
+
+<!-- account-store-ownership-2026-10-24 -->
+## Local account logout and session ownership (unpublished)
+
+Account logout tasks use a separate key in the configured secure store. Custom stores must support multiple opaque keys, atomic value replacement and isolation to the current OS user and host. Account lifecycle operations are coordinated across local instances/processes, independently of the licensing cache directory.
+
+Logout also records a local, session-specific account exit intent using hashes of the account scope and bearer; it stores no bearer or licensing grant there. Restore checks that intent before requesting identity, so a failed vault write or lifecycle-lock timeout cannot turn an interrupted logout into a remembered login. A storage failure is reported explicitly. If both vault persistence and local intent storage are unavailable, handle the failure and retry before terminating; the SDK does not claim durable completion.
+
+An old instance only changes its own account record and logout task. Repeating a completed logout does not adopt a newer remembered account. Retrying other sessions' account tasks never opens their licensing runtime. Licentivo owns device revocation, signed leases, offline permission and its shared cache files; ordinary close still preserves remembered login.

data/lib/licentivo_launch/vendor/licentivo.rb

@@ -4,7 +4,7 @@ require 'json'
 require 'monitor'
 
 module Licentivo
-  VERSION = '0.11.1'
+  VERSION = '0.11.2'
 
   class Error < StandardError
     attr_reader :code, :http_status, :request_id, :retryable, :retry_after_seconds
@@ -71,6 +71,7 @@ module Licentivo
           resolve_metered_feature: ['ln_resolve_metered_feature', [p,p,i], i],
           validate: ['ln_validate', [p], i], heartbeat: ['ln_heartbeat', [p], i],
           refresh_online: ['ln_refresh_online', [p], i], deactivate: ['ln_deactivate', [p], i],
+          logout: ['ln_logout', [p], i], retry_pending_logouts: ['ln_retry_pending_logouts', [p], i], logout_pending: ['ln_logout_pending', [p], i],
           reserve: ['ln_reserve', [p,p,q,p], p], consume: ['ln_consume', [p,p,q,p], p],
           commit: ['ln_commit', [p,p,p], p], cancel: ['ln_cancel', [p,p,p], p],
           offline_request: ['ln_offline_request', [p,p], p], import_offline: ['ln_import_offline', [p,p,p], i],
@@ -154,9 +155,15 @@ module Licentivo
     def validate = checked(:validate)
     def heartbeat = checked(:heartbeat)
     def refresh_online = checked(:refresh_online)
-    def deactivate = checked(:deactivate)
-    def status = read_json(:status)
-    def feature_status(feature) = read_json(:feature_status, Native.input(feature))
+    def deactivate = logout
+    def logout
+      @signed_out = true
+      checked(:logout)
+    end
+    def retry_pending_logouts = checked(:retry_pending_logouts)
+    def logout_pending? = @lock.synchronize { Native.call(:logout_pending, active) != 0 }
+    def status = @signed_out ? signed_out_status : read_json(:status)
+    def feature_status(feature) = @signed_out ? signed_out_status : read_json(:feature_status, Native.input(feature))
     def reserve(feature, quantity, job_id) = read_json(:reserve, Native.input(feature), integer(quantity), Native.input(job_id))
     def consume(feature, quantity, job_id) = read_json(:consume, Native.input(feature), integer(quantity), Native.input(job_id))
     def commit(reservation_id, job_id) = read_json(:commit, Native.input(reservation_id), Native.input(job_id))
@@ -190,6 +197,7 @@ module Licentivo
     end
 
     private
+    def signed_out_status = { 'state' => 'released', 'allowed' => false, 'code' => 'LAUNCH_LOGIN_REQUIRED', 'request_id' => '', 'retryable' => false, 'lease_valid_until' => 0 }
     def integer(value)
       raise ArgumentError, 'Quantity must be a positive signed 64-bit integer' unless value.is_a?(Integer) && value.positive? && value <= 0x7fff_ffff_ffff_ffff
       value
@@ -210,7 +218,10 @@ module Licentivo
         retryable: info[212,4].unpack1('i') != 0, retry_after_seconds: info[216,4].unpack1('i'))
     end
     def checked(name, *arguments)
-      @lock.synchronize { raise error if Native.call(name, active, *arguments) == 0 }
+      @lock.synchronize do
+        raise Error.new('Complete a fresh login', code: 'LAUNCH_LOGIN_REQUIRED') if @signed_out && ![:logout, :deactivate, :retry_pending_logouts].include?(name)
+        raise error if Native.call(name, active, *arguments) == 0
+      end
       true
     end
     def read_json(name, *arguments)
@@ -221,6 +232,7 @@ module Licentivo
       end
     end
     def run_callback(name, *arguments)
+      raise Error.new('Complete a fresh login', code: 'LAUNCH_LOGIN_REQUIRED') if @signed_out
       raise ArgumentError, 'Supply your business operation as a block' unless block_given?
       @lock.synchronize do
         raise Error.new('A business callback is already running', code: 'WORKFLOW_BUSY') if @in_callback

data/lib/licentivo_launch.rb

@@ -11,7 +11,7 @@ require 'time'
 require 'monitor'
 
 module LicentivoLaunch
-  VERSION = '0.1.2'
+  VERSION = '0.1.3'
   LIMIT = 1 << 20
   UUID = /\A[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}\z/
   class Error < StandardError
@@ -163,12 +163,13 @@ module LicentivoLaunch
       @store, @transport = store, transport || LicentivoLaunch.method(:default_transport)
       @factory = runtime_factory || lambda do |config|
         require_relative 'licentivo_launch/vendor/licentivo'
-        raise Error.new('SDK_VERSION_MISMATCH') unless Licentivo::VERSION == '0.11.1'
+        raise Error.new('SDK_VERSION_MISMATCH') unless Licentivo::VERSION == '0.11.2'
         Licentivo::Client.new(config)
       end
       @root = File.expand_path(cache_dir || File.join(Dir.home, '.cache', 'LicentivoLaunch'))
-      @scope = ['launch-session-v1', @launch['merchant_origin'], @launch['launch_product_id'], @launch['licentivo_product_id'], @launch['environment']].join("\n")
+      @scope = ['launch-account-v2', @launch['merchant_origin'], @launch['launch_product_id'], @launch['licentivo_product_id'], @launch['environment']].join("\n")
       @lock, @closed, @in_callback, @attempts = Monitor.new, false, false, pending_attempts
+      @account_cleared = false
       @wait = sleep || lambda { |seconds, cancellation| (seconds * 10).ceil.times { cancellation&.check!; Kernel.sleep(0.1) }; cancellation&.check! }
     end
     def self.connect(merchant_origin, product_id, licentivo_product_id, trusted_keys, environment: 'live', **options)
@@ -177,23 +178,33 @@ module LicentivoLaunch
     end
     def self.from_files(launch_path, product_path, **options) = new(*LicentivoLaunch.load_config(launch_path, product_path), **options)
     def login(email, password, cancellation: nil)
-      serial do
-        cancellation&.check!; logout_internal(cancellation)
+      account_serial do
+        cancellation&.check!; raise Error.new('LOGOUT_PENDING') unless logout_internal(cancellation)
         grant = call('/auth/login', method: 'POST', body: { email: email, password: password, kind: 'desktop' }, cancellation: cancellation)
-        @record = { 'version' => 1, 'scope' => @scope, 'user' => grant['user'], 'token' => grant['access_token'], 'expires_at' => grant['expires_at'] }
+        @record = { 'version' => 2, 'scope' => @scope, 'user' => grant['user'], 'token' => grant['access_token'], 'expires_at' => grant['expires_at'] }
+        @account_cleared = false
         begin
           raise Error.new('INVALID_SESSION') unless valid_identity?(@record) && expiry(@record) > Time.now
           @record['credential'] = credential(cancellation)
-          state = start_runtime(false, cancellation); @store.save(@scope, @record); state
-        rescue StandardError
-          logout_internal(nil); raise
+          state = start_runtime(false, cancellation); @store.save(@scope, @record.merge('credential' => @record['credential'].select { |key, _| %w[product_id licentivo_product_id launch_connection_id environment expires_at].include?(key) })); state
+        rescue StandardError => original
+          begin; logout_internal(nil); rescue StandardError; end
+          raise original
         end
       end
     end
     def restore(cancellation: nil)
-      serial do
-        cancellation&.check!; stop; @record = saved
+      account_serial do
+        cancellation&.check!; stop; @record = @record&.dig('logout_pending') ? @record : saved
+        task = pending_accounts.find { |record| !@record || record['token'] == @record['token'] }
+        @record = task if task
         next nil unless @record
+        @record = @record.merge('version'=>3,'logout_pending'=>true) if has_intent?(@record)
+        if @record['logout_pending']
+          raise Error.new('ACCOUNT_LOGOUT_PENDING') unless logout_internal(cancellation)
+          next nil
+        end
+        retry_other_accounts(@record['token'], cancellation)
         if expiry(@record) <= Time.now
           clear; raise Error.new('SESSION_EXPIRED')
         end
@@ -203,12 +214,12 @@ module LicentivoLaunch
           @record['credential'] = credential(cancellation); @record['user'] = me['user']
         rescue Error => e
           cancellation&.check!
-          next start_runtime(true, cancellation) if e.code == 'NETWORK_UNAVAILABLE' || (500..599).cover?(e.status)
+
           clear if e.code != 'ENTITLEMENT_PENDING' && ([401, 403, 404].include?(e.status) || %w[SESSION_EXPIRED SESSION_MISMATCH ENTITLEMENT_EXPIRED ENTITLEMENT_SUSPENDED ENTITLEMENT_NOT_PURCHASED].include?(e.code))
           raise
         end
         begin
-          state = start_runtime(false, cancellation); @store.save(@scope, @record); state
+          state = start_runtime(false, cancellation); @store.save(@scope, @record.merge('credential' => @record['credential'].select { |key, _| %w[product_id licentivo_product_id launch_connection_id environment expires_at].include?(key) })); state
         rescue StandardError
           clear; raise
         end
@@ -226,28 +237,50 @@ module LicentivoLaunch
         end
       end
     end
-    def logout(cancellation: nil) = serial { logout_internal(cancellation) }
+    def logout(cancellation: nil)
+      account_serial(true) { if @account_cleared && !@record; retry_other_accounts(nil,cancellation);true;else;logout_internal(cancellation);end }
+    end
     def release_device(cancellation: nil)
-      serial do
-        cancellation&.check!
-        raise Error.new('LOGIN_REQUIRED') unless @runtime
-        begin
-          @runtime.deactivate; cancellation&.check!
-        ensure
-          logout_internal(cancellation)
-        end
-      end
+      logout(cancellation: cancellation)
     end
     def close
+      pending = false
       @lock.synchronize do
         raise Error.new('WORKFLOW_BUSY') if @in_callback
         return if @closed
         @closed = true
+        pending = @record&.dig('logout_pending')
         begin; stop; ensure; @record = nil; end
       end
     end
 
     private
+    def account_serial(logout = false)
+      serial do
+        begin
+        begin; remember_intent(@record) if logout && @record; rescue SystemCallError, IOError; end
+        root = File.join(Dir.home, '.cache', 'LicentivoLaunch', 'account-locks', 'ruby')
+        FileUtils.mkdir_p(root, mode: 0o700)
+        File.open(File.join(root, Digest::SHA256.hexdigest(@scope) + '.lock'), File::RDWR | File::CREAT, 0o600) do |file|
+          deadline = Process.clock_gettime(Process::CLOCK_MONOTONIC) + 5
+          until file.flock(File::LOCK_EX | File::LOCK_NB)
+            raise Error.new('ACCOUNT_LOCK_BUSY') if Process.clock_gettime(Process::CLOCK_MONOTONIC) >= deadline
+            Kernel.sleep(0.02)
+          end
+          begin; yield; ensure; file.flock(File::LOCK_UN); end
+        end
+        rescue StandardError
+          if logout
+            if @runtime
+              begin; @runtime.respond_to?(:logout) ? @runtime.logout : @runtime.deactivate; rescue StandardError; end
+            end
+            stop
+            @record = @record.merge('version' => 3, 'logout_pending' => true) if @record
+          end
+          raise
+        end
+      end
+    end
     def serial
       @lock.synchronize do
         raise Error.new('APPLICATION_CLOSED') if @closed
@@ -258,18 +291,19 @@ module LicentivoLaunch
     def cache(record) = File.join(@root, Digest::SHA256.hexdigest(@scope), Digest::SHA256.hexdigest(record.dig('user', 'id')), 'lease.json')
     def expiry(record) = Time.iso8601(record['expires_at'])
     def valid_identity?(record)
-      record.is_a?(Hash) && record['version'] == 1 && record['scope'] == @scope && record['user'].is_a?(Hash) && UUID.match?(record.dig('user', 'id').to_s) && record['token'].is_a?(String) && record['token'].match?(/\A[A-Za-z0-9_-]{43}\z/) && record['expires_at'].is_a?(String) && record['expires_at'].match?(/(?:Z|[+-]\d\d:\d\d)\z/) && expiry(record)
+      record.is_a?(Hash) && record['version'] == 2 && record['scope'] == @scope && record['user'].is_a?(Hash) && UUID.match?(record.dig('user', 'id').to_s) && record['token'].is_a?(String) && record['token'].match?(/\A[A-Za-z0-9_-]{43}\z/) && record['expires_at'].is_a?(String) && record['expires_at'].match?(/(?:Z|[+-]\d\d:\d\d)\z/) && expiry(record)
     rescue ArgumentError, TypeError
       false
     end
     def saved
       record = @store.load(@scope)
-      if record && !(valid_identity?(record) && record['credential'].is_a?(Hash) && record.dig('credential', 'product_id') == @launch['launch_product_id'] && record.dig('credential', 'license_key').is_a?(String) && !record.dig('credential', 'license_key').empty?)
+      if record.is_a?(Hash) && record['logout_pending'] == true && [2, 3].include?(record['version']) && record['scope'] == @scope && record['token'].is_a?(String) && !record['token'].empty?
+        return record
+      end
+      if record && !(valid_identity?(record) && record['credential'].is_a?(Hash) && record.dig('credential', 'product_id') == @launch['launch_product_id'] && UUID.match?(record.dig('credential', 'launch_connection_id').to_s) && !record.dig('credential', 'identity_token'))
         clear(record); raise Error.new('INVALID_SAVED_SESSION')
       end
       record
-    rescue StandardError
-      @store.delete(@scope); raise
     end
     def call(path, method: 'GET', body: nil, cancellation: nil, token: @record&.fetch('token', nil))
       cancellation&.check!
@@ -295,29 +329,18 @@ module LicentivoLaunch
       data['data']
     end
     def credential(cancellation)
-      @attempts.times do |attempt|
-        begin
-          value = call("/software/products/#{@launch['launch_product_id']}/credential", method: 'POST', body: { environment: @launch['environment'] }, cancellation: cancellation)
-          raise Error.new('CREDENTIAL_MISMATCH') unless value['product_id'] == @launch['launch_product_id'] && value['license_key'].is_a?(String) && !value['license_key'].empty? && value['version'].is_a?(Integer) && value['version'] >= 1
-          return value
-        rescue Error => e
-          raise unless e.status == 403 && e.code == 'ENTITLEMENT_PENDING' && attempt + 1 < @attempts && e.retry_after_seconds <= 30
-          @wait.call([3, e.retry_after_seconds].max, cancellation); cancellation&.check!
-        end
-      end
+      value = call("/software/products/#{@launch['launch_product_id']}/identity", method: 'POST', body: { environment: @launch['environment'] }, cancellation: cancellation)
+      raise Error.new('IDENTITY_MISMATCH') unless value['product_id'] == @launch['launch_product_id'] && value['licentivo_product_id'] == @product['product_id'] && value['environment'] == @launch['environment'] && UUID.match?(value['launch_connection_id'].to_s) && value['identity_token'].is_a?(String) && value['identity_token'].length.between?(32, 12288)
+      value
     end
     def start_runtime(offline, cancellation)
       cancellation&.check!
       path = cache(@record); FileUtils.mkdir_p(File.dirname(path), mode: 0o700)
-      runtime = @factory.call(@product.merge('license_key' => @record.dig('credential', 'license_key'), 'cache_path' => path))
+      context = @record.fetch('credential')
+      runtime = @factory.call(@product.merge('license_key' => '', 'identity_token' => context.fetch('identity_token', ''), 'launch_connection_id' => context.fetch('launch_connection_id'), 'environment' => @launch['environment'], 'cache_path' => path))
       begin
-        cancellation&.check!
-        if offline
-          state = runtime.status
-          raise Error.new('OFFLINE_UNAVAILABLE') unless state['allowed'] == true && state['state'] == 'offline_valid'
-        end
-        runtime.start; cancellation&.check!; @runtime = runtime
-        { user: JSON.parse(JSON.generate(@record['user'])), expires_at: @record['expires_at'], offline_fallback: offline }
+        runtime.start; cancellation&.check!; @runtime = runtime; @account_cleared=false
+        { user: JSON.parse(JSON.generate(@record['user'])), expires_at: @record['expires_at'] }
       rescue StandardError
         runtime.close; raise
       end
@@ -327,26 +350,109 @@ module LicentivoLaunch
       runtime&.close
     end
     def clear(record = @record)
-      begin
-        stop
-      ensure
-        @record = nil
+      begin; stop; ensure; @record = nil; @account_cleared=true;delete_owned(record) if record; end
+    end
+    def queue_key = @scope + "\naccount-logout-queue-v1"
+    def intent_path(record)=File.join(Dir.home,'.cache','LicentivoLaunch','account-intents','ruby',Digest::SHA256.hexdigest(@scope)+'.'+Digest::SHA256.hexdigest(record['token'])+'.signedout')
+    def remember_intent(record)
+      path=intent_path(record);FileUtils.mkdir_p(File.dirname(path),mode:0o700)
+      File.open(path,File::WRONLY|File::CREAT,0o600){|file|file.write('1');file.flush;file.fsync}
+    end
+    def has_intent?(record)
+      File.stat(intent_path(record));true
+    rescue Errno::ENOENT
+      false
+    end
+    def pending_accounts
+      queue = @store.load(queue_key)
+      return [] unless queue
+      unless queue.is_a?(Hash) && queue['version'] == 1 && queue['records'].is_a?(Array) && queue['records'].length <= 64 && queue['records'].all? { |record| record.is_a?(Hash) && record['logout_pending'] == true && record['version'] == 3 && record['scope'] == @scope && record['token'].is_a?(String) && !record['token'].empty? && !record.dig('credential', 'identity_token') }
+        raise Error.new('INVALID_SAVED_SESSION')
+      end
+      queue['records']
+    end
+    def update_pending(record, remove: false)
+      records = pending_accounts.reject { |value| value['token'] == record['token'] }
+      unless remove
+        public_record = record.merge('version' => 3, 'logout_pending' => true, 'credential' => (record['credential'] || {}).select { |key, _| %w[product_id licentivo_product_id launch_connection_id environment expires_at].include?(key) })
+        records << public_record
+      end
+      raise Error.new('ACCOUNT_LOGOUT_QUEUE_FULL') if records.length > 64 || JSON.generate({ 'version' => 1, 'records' => records }).bytesize > 60000
+      records.empty? ? @store.delete(queue_key) : @store.save(queue_key, { 'version' => 1, 'records' => records })
+    end
+    def owns?(record)
+      active = @store.load(@scope)
+      record && active && active['token'] == record['token']
+    end
+    def delete_owned(record)
+      @store.delete(@scope) if owns?(record)
+    end
+    def mark_logout(record)
+      begin;remember_intent(record);rescue SystemCallError, IOError;end
+      queue_failure = nil
+      begin; update_pending(record); rescue StandardError => error; queue_failure = error; end
+      if owns?(record)
         begin
-          @store.delete(@scope)
-        ensure
-          FileUtils.rm_rf(File.dirname(cache(record))) if record.is_a?(Hash) && record['user'].is_a?(Hash) && UUID.match?(record.dig('user', 'id').to_s)
+          stored = record.merge('credential' => (record['credential'] || {}).select { |key, _| %w[product_id licentivo_product_id launch_connection_id environment expires_at].include?(key) })
+          @store.save(@scope, stored)
+          return
+        rescue StandardError
+          begin; delete_owned(record); rescue StandardError; end
         end
       end
+      raise Error.new('ACCOUNT_LOGOUT_STORAGE_FAILED') if queue_failure
+    end
+    def finish_account(record)
+      delete_owned(record)
+      update_pending(record, remove: true)
+      begin;File.unlink(intent_path(record));rescue Errno::ENOENT;end
+    end
+    def retry_other_accounts(skip, cancellation)
+      pending_accounts.each do |record|
+        next if record['token'] == skip
+        begin; call('/auth/logout', method: 'POST', body: {}, cancellation: cancellation, token: record['token'])
+        rescue StandardError => error
+          raise Error.new('ACCOUNT_LOGOUT_PENDING') unless error.is_a?(Error) && error.status == 401
+        end
+        finish_account(record)
+      end
     end
     def logout_internal(cancellation)
-      record = @record || saved
-      clear(record)
-      return true unless record
+      record = @record || saved || pending_accounts.first
+      failure, persist_failure, other_failure, pending, confirmed = nil, nil, nil, false, true
+      begin; retry_other_accounts(record && record['token'], cancellation); rescue StandardError => error; other_failure = error; end
+      if record
+        @record = record.merge('version' => 3, 'logout_pending' => true)
+        record = @record
+        begin; mark_logout(record); rescue StandardError => error; persist_failure = error; end
+      end
       begin
-        call('/auth/logout', method: 'POST', body: {}, cancellation: cancellation, token: record['token']); true
-      rescue StandardError
-        false
+        active = @store.load(@scope)
+        if !@runtime && record && (!active || active['token'] == record['token']) && record['credential'].is_a?(Hash) && record['credential']['launch_connection_id']
+          context = record.fetch('credential')
+          @runtime = @factory.call(@product.merge('license_key' => '', 'identity_token' => '', 'launch_connection_id' => context.fetch('launch_connection_id'), 'environment' => @launch['environment'], 'cache_path' => cache(record)))
+        end
+        if @runtime
+          result = @runtime.respond_to?(:logout) ? @runtime.logout : @runtime.deactivate
+          pending = (@runtime.respond_to?(:logout_pending?) && @runtime.logout_pending?) || (result.is_a?(Hash) && (result[:revocation_pending] || result['revocation_pending']))
+          raise Error.new('SDK_LOGOUT_STORAGE_FAILED') if result.is_a?(Hash) && (result[:storage_error] || result['storage_error'])
+        end
+      rescue StandardError => error
+        failure = error
+      ensure
+        stop
+      end
+      if record
+        begin; call('/auth/logout', method: 'POST', body: {}, cancellation: cancellation, token: record['token']); rescue StandardError => error; confirmed = error.is_a?(Error) && error.status == 401; end
+      end
+      if confirmed
+        finish_account(record) if record
+        clear(record)
       end
+      raise persist_failure if !confirmed && persist_failure
+      raise failure if failure
+      raise other_failure if other_failure
+      confirmed && !pending
     end
   end
 end

data/vendor/VERSION

@@ -1 +1 @@
-0.11.1
+0.11.2

data/vendor/c/demo.c

@@ -28,6 +28,18 @@ int main(int argc, char **argv) {
     for (int i = 1; i < argc; i++) if (!strcmp(argv[i], "--cache-test")) cache_test = 1;
     ln_client *client = ln_init_file(path);
     if (!client) { fprintf(stderr, "C: invalid configuration\n"); return 1; }
+    for(int i=1;i<argc;i++)if(!strcmp(argv[i],"--logout-wait")){
+        char ready[4096],gate[4096];snprintf(ready,sizeof(ready),"%s.ready",path);snprintf(gate,sizeof(gate),"%s.continue",path);FILE*f=ln_check_feature(client,"export")?fopen(ready,"wb"):NULL;if(!f){ln_destroy(client);return 1;}fputs("ready",f);fclose(f);double deadline=clock_seconds()+30;
+        for(;;){f=fopen(gate,"rb");if(f){fclose(f);break;}if(clock_seconds()>deadline){ln_destroy(client);return 1;}
+#ifdef _WIN32
+            Sleep(10);
+#else
+            struct timespec pause={0,10000000L};nanosleep(&pause,NULL);
+#endif
+        }
+        int ok=ln_logout(client)&&!ln_check_feature(client,"export");ln_destroy(client);return ok?0:1;
+    }
+    for(int i=1;i<argc;i++)if(!strcmp(argv[i],"--logout-retry")){int ok=ln_retry_pending_logouts(client)&&!ln_check_feature(client,"export");ln_destroy(client);if(ok)puts("C: pending logout completed");return ok?0:1;}
     for(int i=1;i<argc;i++)if(!strcmp(argv[i],"--improvements-test")){int ok=improvements(client,path);if(!ok)fprintf(stderr,"C: %s\n",ln_last_error(client));ln_destroy(client);if(ok)puts("C: credential / reservation / typed status OK");return ok?0:1;}
     for(int i=1;i<argc;i++)if(!strcmp(argv[i],"--startup-test")){double start=clock_seconds();int ok=ln_start(client)&&clock_seconds()-start<.3;start=clock_seconds();ok=ok&&ln_check_feature(client,"export")&&clock_seconds()-start<.3;ln_destroy(client);if(ok)puts("C: cached startup and local feature checks stay responsive");return ok?0:1;}
     int advanced=0,offline_export=0,offline_import=0,floating=0;
@@ -37,7 +49,7 @@ int main(int argc, char **argv) {
         int ok=1;if(!strcmp(argv[i],"--transfer-import")){char file[4096];snprintf(file,sizeof(file),"%s.request.json",path);char*req=read_text(file);snprintf(file,sizeof(file),"%s.response.json",path);char*res=read_text(file);ok=req&&res&&ln_import_offline(client,req,res);free(req);free(res);}else ok=ln_start(client);
         ok=ok&&ln_validate(client)&&ln_heartbeat(client)&&ln_check_feature(client,"export");if(!ok)fprintf(stderr,"C: %s\n",ln_last_error(client));ln_destroy(client);if(ok)puts("C: transferred device credential OK");return ok?0:1;
     }
-    if(floating){int ok=ln_start(client);ln_client*other=ln_init_file(path);ok=ok&&other&&!ln_check_feature(other,"export")&&!ln_start(other);ln_destroy(client);ok=ok&&ln_start(other)&&ln_check_feature(other,"export");ln_destroy(other);if(ok)puts("C: floating seat release OK");return ok?0:1;}
+    if(floating){int ok=ln_start(client);ln_client*other=ln_init_file(path);ok=ok&&other&&!ln_check_feature(other,"export")&&ln_start(other);ln_destroy(client);ok=ok&&ln_start(other)&&ln_check_feature(other,"export");ln_destroy(other);if(ok)puts("C: floating seat release OK");return ok?0:1;}
     if(advanced||offline_import){int ok=1;
         if(offline_import){char file[4096];snprintf(file,sizeof(file),"%s.request.json",path);char*req=read_text(file);snprintf(file,sizeof(file),"%s.response.json",path);char*res=read_text(file);ok=req&&res&&ln_import_offline(client,req,res);free(req);free(res);}else ok=ln_start(client);
         ok=ok&&ln_check_feature(client,"export");char*r=ok?ln_consume(client,"export",1,"business-job-1"):NULL;ok=ok&&used_is(r,1,0);ln_free_string(r);

data/vendor/c/device_logout.h

@@ -0,0 +1,92 @@
+/* Internal implementation, included after the transport helpers in licentivo.c. */
+static char*logout_path(ln_client*c){const char*p=text(c->cfg,"cache_path");if(!p)return NULL;char*out=malloc(strlen(p)+13);if(out)sprintf(out,"%s.logout.json",p);return out;}
+static cJSON*pending_logouts(ln_client*c){return (cJSON*)get(c->logout_state,"pending");}
+static int has_pending_logouts(ln_client*c){return cJSON_GetArraySize(pending_logouts(c))>0;}
+static void new_logout_state(ln_client*c){c->logout_state=cJSON_CreateObject();cJSON_AddNumberToObject(c->logout_state,"version",1);cJSON_AddStringToObject(c->logout_state,"source_hash","");cJSON_AddBoolToObject(c->logout_state,"signed_out",0);cJSON_AddArrayToObject(c->logout_state,"pending");}
+static const char*logout_text(const cJSON*s,const char*key){const char*v=text(s,key);return v?v:"";}
+static void logout_binding(const cJSON*t,char out[80]){int64_t generation=0;const char*a=text(t,"activation_id");if(a&&num(t,"expected_generation",&generation))snprintf(out,80,"%s:%lld",a,(long long)generation);else out[0]=0;}
+static char*logout_directory(ln_client*c){
+ const char*root=getenv("LOCALAPPDATA");if(!root||!root[0])root=getenv("XDG_CACHE_HOME");char*owned=NULL;
+ if(!root||!root[0]){const char*home=getenv("HOME");if(!home||!home[0])return NULL;owned=malloc(strlen(home)+8);if(!owned)return NULL;sprintf(owned,"%s/.cache",home);root=owned;}
+ const char*cache=text(c->cfg,"cache_path");char*absolute=NULL;
+#ifdef _WIN32
+ wchar_t*wide=state_windows_path(cache);if(wide){const wchar_t*start=!wcsncmp(wide,L"\\\\?\\",4)?wide+4:wide;int n=WideCharToMultiByte(CP_UTF8,0,start,-1,NULL,0,NULL,NULL);absolute=malloc((size_t)n);if(absolute)WideCharToMultiByte(CP_UTF8,0,start,-1,absolute,n,NULL,NULL);free(wide);}
+#else
+ if(cache[0]=='/')absolute=strdup(cache);else{char*cwd=getcwd(NULL,0);if(cwd){absolute=malloc(strlen(cwd)+strlen(cache)+2);if(absolute)sprintf(absolute,"%s/%s",cwd,cache);free(cwd);}}
+#endif
+ if(!absolute){free(owned);return NULL;}size_t n=strlen(absolute)+strlen(text(c->cfg,"base_url"))+strlen(text(c->cfg,"product_id"))+strlen(text(c->cfg,"device_id"))+4;char*context=malloc(n);char scope[65];
+ if(!context){free(absolute);free(owned);return NULL;}snprintf(context,n,"%s\n%s\n%s\n%s",absolute,text(c->cfg,"base_url"),text(c->cfg,"product_id"),text(c->cfg,"device_id"));int ok=hash(context,scope);free(absolute);free(context);char*out=ok?malloc(strlen(root)+strlen(scope)+20):NULL;if(out)sprintf(out,"%s/Licentivo/logout/%s",root,scope);free(owned);return out;
+}
+static char*logout_scope(const cJSON*s){const char*a=logout_text(s,"source_hash"),*b=logout_text(s,"binding_key");char*out=malloc(strlen(a)+strlen(b)+2);if(out)sprintf(out,"%s\n%s",a,b);return out;}
+static int save_logout_state(ln_client*c){
+ int64_t revision=0;num(c->logout_state,"revision",&revision);int64_t now=(int64_t)time(NULL)*1000;revision=revision+1>now?revision+1:now;cJSON_DeleteItemFromObjectCaseSensitive(c->logout_state,"revision");cJSON_AddNumberToObject(c->logout_state,"revision",(double)revision);
+ char*dir=logout_directory(c),*scope=logout_scope(c->logout_state),h[65];int fallback=0;if(dir&&scope&&hash(scope,h)){char*p=malloc(strlen(dir)+72);if(p){sprintf(p,"%s/%s.json",dir,h);fallback=write_state(p,c->logout_state);free(p);}}free(dir);free(scope);
+ char*p=logout_path(c);int primary=p&&write_state(p,c->logout_state);free(p);return fallback||(cJSON_IsTrue(get(c->logout_state,"signed_out"))&&primary);
+}
+static void read_logout_record(ln_client*c,cJSON*records,const char*path){
+ errno=0;char*b=readfile(path,65536);int absent=errno==ENOENT;if(!b){if(!absent)set_denied(c);return;}cJSON*s=ln_json(b);free(b);int64_t version;
+ if(!s||!num(s,"version",&version)||version!=1||!cJSON_IsArray(get(s,"pending"))){cJSON_Delete(s);set_denied(c);return;}char*scope=logout_scope(s);if(scope){const cJSON*old=get(records,scope);int64_t before=0,after=0;num(old,"revision",&before);num(s,"revision",&after);if(!old||after>before||(after==before&&(cJSON_IsTrue(get(s,"signed_out"))||!cJSON_IsTrue(get(old,"signed_out"))))){cJSON_DeleteItemFromObjectCaseSensitive(records,scope);cJSON_AddItemToObject(records,scope,s);}else cJSON_Delete(s);free(scope);}else cJSON_Delete(s);
+}
+static cJSON*logout_records(ln_client*c){
+ cJSON*records=cJSON_CreateObject();char*p=logout_path(c);if(p){read_logout_record(c,records,p);free(p);}else set_denied(c);char*dir=logout_directory(c);
+ if(dir){
+#ifdef _WIN32
+  char*pattern=malloc(strlen(dir)+8);if(pattern){sprintf(pattern,"%s/*.json",dir);wchar_t*wide=state_windows_path(pattern);free(pattern);WIN32_FIND_DATAW data;HANDLE search=wide?FindFirstFileW(wide,&data):INVALID_HANDLE_VALUE;free(wide);if(search!=INVALID_HANDLE_VALUE){do{char name[256];int n=WideCharToMultiByte(CP_UTF8,0,data.cFileName,-1,name,sizeof(name),NULL,NULL);if(n>0){p=malloc(strlen(dir)+strlen(name)+2);if(p){sprintf(p,"%s/%s",dir,name);read_logout_record(c,records,p);free(p);}}}while(FindNextFileW(search,&data));FindClose(search);}else if(GetLastError()!=ERROR_FILE_NOT_FOUND&&GetLastError()!=ERROR_PATH_NOT_FOUND)set_denied(c);}
+#else
+  DIR*entries=opendir(dir);if(entries){struct dirent*entry;while((entry=readdir(entries))){size_t n=strlen(entry->d_name);if(n>5&&!strcmp(entry->d_name+n-5,".json")){p=malloc(strlen(dir)+n+2);if(p){sprintf(p,"%s/%s",dir,entry->d_name);read_logout_record(c,records,p);free(p);}}}closedir(entries);}else if(errno!=ENOENT)set_denied(c);
+#endif
+  free(dir);
+ }
+ return records;
+}
+static void load_logout_state(ln_client*c){
+ new_logout_state(c);c->logout_bindings=cJSON_CreateObject();cJSON*records=logout_records(c);
+ char h[65]="",binding[80];source_hash(c,h);logout_binding(get(c->auth,"logout_ticket"),binding);cJSON*tickets=cJSON_CreateArray();
+ for(cJSON*s=records->child;s;s=s->next){const char*b=logout_text(s,"binding_key");if(b[0]&&cJSON_IsTrue(get(s,"signed_out"))&&!get(c->logout_bindings,b))cJSON_AddBoolToObject(c->logout_bindings,b,1);}
+ for(cJSON*s=records->child;s;s=s->next){const char*b=logout_text(s,"binding_key");if((!strcmp(h,logout_text(s,"source_hash"))||(logout_text(c->cfg,"launch_connection_id")[0]&&binding[0]&&!strcmp(b,binding))||(!c->auth&&!source_input(c)[0]))&&(!b[0]||!binding[0]||!strcmp(b,binding))){cJSON_Delete(c->logout_state);c->logout_state=cJSON_Duplicate(s,1);if(cJSON_IsTrue(get(s,"signed_out"))&&!text(c->cfg,"license_key")[0])set_denied(c);}for(const cJSON*t=get(s,"pending")->child;t;t=t->next){int found=0;for(cJSON*x=tickets->child;x;x=x->next)if(!strcmp(logout_text(t,"operation_id"),logout_text(x,"operation_id")))found=1;if(!found)cJSON_AddItemToArray(tickets,cJSON_Duplicate(t,1));}}
+ cJSON_ReplaceItemInObjectCaseSensitive(c->logout_state,"pending",tickets);cJSON_Delete(records);
+ if(is_denied(c)){cJSON_Delete(c->auth);c->auth=NULL;}
+}
+static int acknowledge_logout(ln_client*c,const char*operation){
+ cJSON*records=logout_records(c);char*dir=logout_directory(c);int ok=dir!=NULL;
+ for(cJSON*s=records->child;s&&ok;s=s->next){cJSON*pending=(cJSON*)get(s,"pending");int changed=0;for(int i=cJSON_GetArraySize(pending)-1;i>=0;i--){if(!strcmp(logout_text(cJSON_GetArrayItem(pending,i),"operation_id"),operation)){cJSON_DeleteItemFromArray(pending,i);changed=1;}}
+  if(changed){char*scope=logout_scope(s),h[65];ok=scope&&hash(scope,h);if(ok){char*p=malloc(strlen(dir)+72);ok=p!=NULL;if(p){sprintf(p,"%s/%s.json",dir,h);ok=write_state(p,s);free(p);}}free(scope);}
+ }
+ free(dir);cJSON_Delete(records);return ok;
+}
+static int revocation_error(const char*code){const char*codes[]={"LICENSE_REVOKED","LICENSE_SUSPENDED","LICENSE_EXPIRED","DEVICE_RELEASED","DEVICE_NOT_ACTIVE","DEVICE_CREDENTIAL_REVOKED","DEVICE_CREDENTIAL_INVALID","AUTHORIZATION_SESSION_REVOKED","AUTHORIZATION_SESSION_EXPIRED","LAUNCH_LOGIN_REQUIRED","LAUNCH_ENTITLEMENT_REVOKED","LAUNCH_ENTITLEMENT_EXPIRED"};for(size_t i=0;i<sizeof(codes)/sizeof(codes[0]);i++)if(!strcmp(code,codes[i]))return 1;return 0;}
+static int deny_runtime(ln_client*c){
+ set_denied(c);if(!c->logout_state)new_logout_state(c);char h[65];
+ if((source_input(c)[0]||c->auth)&&source_hash(c,h))cJSON_ReplaceItemInObjectCaseSensitive(c->logout_state,"source_hash",cJSON_CreateString(h));
+ cJSON_ReplaceItemInObjectCaseSensitive(c->logout_state,"signed_out",cJSON_CreateBool(1));
+ const cJSON*ticket=get(c->auth,"logout_ticket");const char*operation=text(ticket,"operation_id");int found=0;
+ char binding[80];logout_binding(ticket,binding);if(binding[0]){cJSON_DeleteItemFromObjectCaseSensitive(c->logout_state,"binding_key");cJSON_AddStringToObject(c->logout_state,"binding_key",binding);if(c->logout_bindings&&!get(c->logout_bindings,binding))cJSON_AddBoolToObject(c->logout_bindings,binding,1);}
+ if(operation){for(cJSON*p=pending_logouts(c)->child;p;p=p->next)if(text(p,"operation_id")&&!strcmp(operation,text(p,"operation_id")))found=1;if(!found)cJSON_AddItemToArray(pending_logouts(c),cJSON_Duplicate(ticket,1));}
+ int ok=save_logout_state(c);invalidate(c);cJSON_Delete(c->auth);c->auth=NULL;c->auth_dirty=0;
+ /* Keep the immutable configuration graph stable for concurrent local checks. */
+ const char*private_names[]={"license_key","identity_token"};for(int i=0;i<2;i++){char*secret=(char*)text(c->cfg,private_names[i]);if(secret){size_t count=strlen(secret);volatile unsigned char*p=(volatile unsigned char*)secret;while(count--)*p++=0;}}return ok;
+}
+static int logout_binding_blocked(ln_client*c,const cJSON*result){
+ const char*connection=text(c->cfg,"launch_connection_id");char binding[80];const cJSON*ticket=get(result,"logout_ticket");logout_binding(ticket,binding);
+ if(!connection||!connection[0]||!cJSON_IsTrue(get(c->logout_bindings,binding)))return 0;
+ if(c->auth){cJSON_DeleteItemFromObjectCaseSensitive(c->auth,"logout_ticket");cJSON_AddItemToObject(c->auth,"logout_ticket",cJSON_Duplicate(ticket,1));}deny_runtime(c);strcpy(c->error,"LAUNCH_LOGIN_REQUIRED");return 1;
+}
+static int retry_logouts_unlocked(ln_client*c){
+ while(has_pending_logouts(c)){
+  cJSON*ticket=cJSON_GetArrayItem(pending_logouts(c),0);char*body=cJSON_PrintUnformatted(ticket);const char*base=text(c->cfg,"base_url");char*url=malloc(strlen(base)+32);if(!body||!url){free(body);free(url);return 0;}sprintf(url,"%s/api/v1/sessions/logout",base);
+  CURL*curl=curl_easy_init();if(!curl){free(body);free(url);return 0;}struct buffer b={{0},0,0};struct curl_slist*headers=curl_slist_append(NULL,"Content-Type: application/json");
+  curl_easy_setopt(curl,CURLOPT_URL,url);curl_easy_setopt(curl,CURLOPT_POSTFIELDS,body);curl_easy_setopt(curl,CURLOPT_HTTPHEADER,headers);curl_easy_setopt(curl,CURLOPT_WRITEFUNCTION,receive);curl_easy_setopt(curl,CURLOPT_WRITEDATA,&b);curl_easy_setopt(curl,CURLOPT_TIMEOUT,5L);curl_easy_setopt(curl,CURLOPT_CONNECTTIMEOUT,5L);curl_easy_setopt(curl,CURLOPT_NOSIGNAL,1L);curl_easy_setopt(curl,CURLOPT_FOLLOWLOCATION,0L);curl_easy_setopt(curl,CURLOPT_SSL_VERIFYPEER,1L);curl_easy_setopt(curl,CURLOPT_SSL_VERIFYHOST,2L);
+  const char*proxy=text(c->cfg,"proxy_url"),*ca=getenv("LICENTIVO_CA_BUNDLE");if(proxy&&proxy[0])curl_easy_setopt(curl,CURLOPT_PROXY,proxy);if(ca&&ca[0])curl_easy_setopt(curl,CURLOPT_CAINFO,ca);
+  CURLcode error=curl_easy_perform(curl);long status=0;curl_easy_getinfo(curl,CURLINFO_RESPONSE_CODE,&status);curl_easy_cleanup(curl);curl_slist_free_all(headers);free(body);free(url);
+  cJSON*envelope=error==CURLE_OK&&!b.oversized?ln_json(b.data):NULL;const cJSON*ack=get(envelope,"data");const char*state=text(ack,"status"),*operation=text(ack,"operation_id"),*activation=text(ack,"activation_id");int64_t generation=0,expected=0;
+  int ok=status==200&&state&&(!strcmp(state,"succeeded")||!strcmp(state,"stale"))&&operation&&activation&&text(ticket,"operation_id")&&text(ticket,"activation_id")&&!strcmp(operation,text(ticket,"operation_id"))&&!strcmp(activation,text(ticket,"activation_id"))&&num(ack,"expected_generation",&generation)&&num(ticket,"expected_generation",&expected)&&generation==expected;cJSON_Delete(envelope);if(!ok)return 0;
+  char completed[128];snprintf(completed,sizeof(completed),"%s",logout_text(ticket,"operation_id"));cJSON_DeleteItemFromArray(pending_logouts(c),0);if(!acknowledge_logout(c,completed)||!save_logout_state(c))return 0;
+ }
+ return 1;
+}
+int ln_retry_pending_logouts(ln_client*c){if(!c)return 0;lock(c);int ok=retry_logouts_unlocked(c);unlock(c);return ok;}
+int ln_logout_pending(ln_client*c){if(!c)return 0;lock(c);int pending=has_pending_logouts(c);unlock(c);return pending;}
+int ln_logout(ln_client*c){
+ if(!c)return 0;
+ set_denied(c);lock(c);int ok=deny_runtime(c);retry_logouts_unlocked(c);int pending=has_pending_logouts(c);strcpy(c->error,ok?"DEVICE_RELEASED":"LOCAL_CREDENTIAL_CLEANUP_FAILED");publish(c,0);unlock(c);notify(c);if(pending)ln_start_heartbeat(c);return ok;
+}

data/vendor/c/licentivo.c

@@ -15,17 +15,51 @@
 #include <math.h>
 #include <errno.h>
 #include <sys/stat.h>
+#include <wchar.h>
 #ifdef _WIN32
 #include <windows.h>
 #include <bcrypt.h>
 #include <direct.h>
-#define mkdir_private(p) _mkdir(p)
+#include <io.h>
+/* State journals can exceed MAX_PATH under a caller's cache directory. Use
+ * absolute UTF-16 paths with the extended prefix for every state-file operation. */
+static wchar_t*state_windows_path(const char*path){
+ int size=MultiByteToWideChar(CP_UTF8,MB_ERR_INVALID_CHARS,path,-1,NULL,0);if(!size){errno=EINVAL;return NULL;}
+ wchar_t*input=malloc((size_t)size*sizeof(wchar_t));if(!input){errno=ENOMEM;return NULL;}
+ if(!MultiByteToWideChar(CP_UTF8,MB_ERR_INVALID_CHARS,path,-1,input,size)){free(input);errno=EINVAL;return NULL;}
+ for(wchar_t*p=input;*p;p++)if(*p==L'/')*p=L'\\';
+ if(!wcsncmp(input,L"\\\\?\\",4))return input;
+ DWORD count=GetFullPathNameW(input,0,NULL,NULL);if(!count||count>32760){free(input);errno=EINVAL;return NULL;}
+ wchar_t*absolute=malloc((size_t)count*sizeof(wchar_t));if(!absolute){free(input);errno=ENOMEM;return NULL;}
+ DWORD written=GetFullPathNameW(input,count,absolute,NULL);free(input);if(!written||written>=count){free(absolute);errno=EINVAL;return NULL;}
+ int unc=absolute[0]==L'\\'&&absolute[1]==L'\\';
+ wchar_t*result=malloc(((size_t)written+9)*sizeof(wchar_t));if(!result){free(absolute);errno=ENOMEM;return NULL;}
+ wcscpy(result,unc?L"\\\\?\\UNC\\":L"\\\\?\\");wcscat(result,absolute+(unc?2:0));free(absolute);return result;
+}
+static FILE*state_windows_open(const char*path,const char*mode){
+ wchar_t*p=state_windows_path(path),wide_mode[8];if(!p)return NULL;size_t length=strlen(mode);if(length>=8){free(p);errno=EINVAL;return NULL;}
+ for(size_t i=0;i<=length;i++){wide_mode[i]=(wchar_t)(unsigned char)mode[i];}
+ FILE*f=_wfopen(p,wide_mode);free(p);return f;
+}
+static int state_windows_remove(const char*path){wchar_t*p=state_windows_path(path);if(!p)return -1;int result=_wremove(p);free(p);return result;}
+static int state_windows_mkdir(const char*path){wchar_t*p=state_windows_path(path);if(!p)return -1;int result=_wmkdir(p);free(p);return result;}
+static int state_windows_stat(const char*path,struct stat*info){
+ wchar_t*p=state_windows_path(path);if(!p)return -1;WIN32_FILE_ATTRIBUTE_DATA data;BOOL ok=GetFileAttributesExW(p,GetFileExInfoStandard,&data);DWORD error=GetLastError();free(p);
+ if(!ok){errno=error==ERROR_FILE_NOT_FOUND||error==ERROR_PATH_NOT_FOUND?ENOENT:EACCES;return -1;}
+ memset(info,0,sizeof(*info));info->st_size=data.nFileSizeHigh||data.nFileSizeLow>2147483647?2147483647:(long)data.nFileSizeLow;return 0;
+}
+static int state_windows_move(const char*from,const char*to){wchar_t*a=state_windows_path(from),*b=state_windows_path(to);int ok=a&&b&&MoveFileExW(a,b,MOVEFILE_REPLACE_EXISTING|MOVEFILE_WRITE_THROUGH);free(a);free(b);return ok;}
+#define fopen(path,mode) state_windows_open(path,mode)
+#define remove(path) state_windows_remove(path)
+#define stat(path,info) state_windows_stat(path,info)
+#define mkdir_private(p) state_windows_mkdir(p)
 #else
 #include <openssl/evp.h>
 #include <openssl/rand.h>
 #include <pthread.h>
 #include <stdatomic.h>
 #include <unistd.h>
+#include <dirent.h>
 #define mkdir_private(p) mkdir(p,0700)
 #endif
 #define LIMIT 16384
@@ -48,14 +82,29 @@ static int ensure_curl(void) { return pthread_once(&curl_once, initialize_curl)
 #endif
 
 struct ln_client {
- cJSON *cfg,*cached,*auth;int auth_dirty;char session[37];int interval;int offline;int64_t wall;double tick;char error[80];int started;int finished;int refresh_pending;int online;int retryable;long http_status;int retry_after;char request_id[128];int64_t retry_at;
+ cJSON *cfg,*cached,*auth,*logout_state,*logout_bindings;int auth_dirty;char session[37];int interval;int offline;int64_t wall;double tick;char error[80];int started;int finished;int refresh_pending;int online;int retryable;long http_status;int retry_after;char request_id[128];int64_t retry_at;
  cJSON *view;int64_t view_wall;double view_tick;int view_online;ln_error_info view_error;ln_status_callback callback;void *callback_data;int task_busy;
 #ifdef _WIN32
- CRITICAL_SECTION mutex,view_mutex;HANDLE thread;volatile LONG stop;
+ CRITICAL_SECTION mutex,view_mutex;HANDLE thread;volatile LONG stop,denied;
 #else
- pthread_mutex_t mutex,view_mutex;pthread_t thread;atomic_int stop;
+ pthread_mutex_t mutex,view_mutex;pthread_t thread;atomic_int stop,denied;
 #endif
 };
+static int is_denied(ln_client*c){
+#ifdef _WIN32
+ return InterlockedCompareExchange(&c->denied,0,0)!=0;
+#else
+ return atomic_load(&c->denied);
+#endif
+}
+static void set_denied(ln_client*c){
+#ifdef _WIN32
+ InterlockedExchange(&c->denied,1);
+#else
+ atomic_store(&c->denied,1);
+#endif
+}
+static void load_logout_state(ln_client*c);static int deny_runtime(ln_client*c);static int revocation_error(const char*code);static int retry_logouts_unlocked(ln_client*c);static int has_pending_logouts(ln_client*c);
 static const cJSON *get(const cJSON *o,const char*k){return cJSON_GetObjectItemCaseSensitive(o,k);}
 static const char *text(const cJSON *o,const char*k){const cJSON*v=get(o,k);return cJSON_IsString(v)?v->valuestring:NULL;}
 static int num(const cJSON*o,const char*k,int64_t*out){const cJSON*v=get(o,k);if(!cJSON_IsNumber(v)||!isfinite(v->valuedouble)||v->valuedouble!=floor(v->valuedouble)||fabs(v->valuedouble)>9007199254740991.0)return 0;*out=(int64_t)v->valuedouble;return 1;}
@@ -65,13 +114,17 @@ static int fields(const cJSON*v,const char*const*names,int n){if(!cJSON_IsObject
 static int uuid(const char*s){if(!s||strlen(s)!=36)return 0;for(int i=0;i<36;i++){if(i==8||i==13||i==18||i==23){if(s[i]!='-')return 0;}else if(!isxdigit((unsigned char)s[i]))return 0;}return 1;}
 static int device(const char*s){if(!s||strlen(s)!=64)return 0;for(int i=0;i<64;i++)if(!((s[i]>='a'&&s[i]<='f')||(s[i]>='0'&&s[i]<='9')))return 0;return 1;}
 static int credential_secret(const char*s,const char*prefix){if(!s||strlen(s)!=50||strncmp(s,prefix,7))return 0;for(int i=7;i<50;i++)if(!isalnum((unsigned char)s[i])&&s[i]!='_'&&s[i]!='-')return 0;return 1;}
-static int temporary(ln_client*c){return c->auth!=NULL||text(c->cfg,"license_key")[0]!=0;}
+static const char*source_input(ln_client*c){const char*identity=text(c->cfg,"identity_token");return identity&&identity[0]?identity:text(c->cfg,"license_key");}
+static int source_hash(ln_client*c,char out[65]);
+static int temporary(ln_client*c){return c->auth!=NULL||source_input(c)[0]!=0;}
 static const char*runtime_key(ln_client*c){const char*k=text(c->auth,"device_key");return k&&k[0]?k:text(c->cfg,"license_key");}
 static void publish(ln_client*c,int online);
 static void notify(ln_client*c);
 static void load_credential(ln_client*c);
 static int prepare_credential(ln_client*c);
 static int accept_credential(ln_client*c,const cJSON*result);
+static int save_logout_state(ln_client*c);
+static int logout_binding_blocked(ln_client*c,const cJSON*result);
 static const char b64chars[]="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
 static int b64(const char*s,unsigned char*out,size_t capacity){if(!s||!s[0])return -1;unsigned int acc=0,bits=0;size_t used=0;for(size_t i=0;s[i];i++){const char*p=strchr(b64chars,s[i]);if(!p||s[i]=='=')return -1;acc=(acc<<6)|(unsigned int)(p-b64chars);bits+=6;if(bits>=8){bits-=8;if(used>=capacity)return -1;out[used++]=(unsigned char)(acc>>bits);}}if(bits==6||(bits&&(acc&((1u<<bits)-1u))))return -1;return (int)used;}
 static int64_t policy_span(const cJSON*c,int64_t issued){
@@ -95,11 +148,12 @@ static int app_version(const char*s){if(!s)return 0;const char*p=s;for(int i=0;i
 static int advanced_claims(const cJSON*c){
  const cJSON*request=get(c,"offline_request_id");if(request&&!uuid(text(c,"offline_request_id")))return 0;const cJSON*x=get(c,"capabilities");if(!x)return 1;if(!cJSON_IsObject(x))return 0;
  const char*model=text(x,"license_model");if(!model||(strcmp(model,"node_locked")&&strcmp(model,"floating")))return 0;
- const char*const allowed[]={"license_model","session_id","session_expires_at","app_version","version_released_at","maintenance_until"};for(const cJSON*v=x->child;v;v=v->next){int ok=0;for(int i=0;i<6;i++)if(!strcmp(v->string,allowed[i]))ok=1;if(!ok)return 0;}
+ const char*const allowed[]={"license_model","session_id","session_expires_at","app_version","version_released_at","maintenance_until","launch_connection_id","environment","binding_version"};for(const cJSON*v=x->child;v;v=v->next){int ok=0;for(int i=0;i<9;i++)if(!strcmp(v->string,allowed[i]))ok=1;if(!ok)return 0;}
  int64_t session=0,released=0,maintenance=0,issued=0,expires=0;const char*const dates[]={"session_expires_at","version_released_at","maintenance_until"};int64_t*values[]={&session,&released,&maintenance};for(int i=0;i<3;i++)if(get(x,dates[i])&&(!num(x,dates[i],values[i])||*values[i]<0||*values[i]>253402300799LL))return 0;
  if(get(x,"app_version")&&!app_version(text(x,"app_version")))return 0;
  if(!num(c,"issued_at",&issued)||!num(c,"expires_at",&expires))return 0;
  const cJSON*policy=get(c,"runtime_policy");int64_t heartbeat=0;if(!strcmp(model,"floating")&&(!uuid(text(x,"session_id"))||session<=issued||expires>session||!num(policy,"heartbeat_seconds",&heartbeat)||heartbeat==0||!strcmp(text(policy,"offline_mode")?text(policy,"offline_mode"):"","permanent")))return 0;
+ if(get(x,"launch_connection_id")||get(x,"environment")||get(x,"binding_version")){int64_t binding=0,h=0,o=0;const char*env=text(x,"environment"),*mode=text(policy,"offline_mode");if(!uuid(text(x,"launch_connection_id"))||!env||(strcmp(env,"live")&&strcmp(env,"sandbox"))||!num(x,"binding_version",&binding)||binding<1||strcmp(model,"node_locked")||!uuid(text(x,"session_id"))||session<=issued||expires>session||!num(policy,"heartbeat_seconds",&h)||h<600||!mode||!strcmp(mode,"permanent")||!num(policy,"offline_seconds",&o)||o>86400)return 0;}
  if(released>issued||(maintenance>0&&(!text(x,"app_version")||released==0||released>maintenance)))return 0;
  return 1;
 }
@@ -196,9 +250,10 @@ static int origin(const cJSON*cfg){CURLU*u=curl_url();if(!u)return 0;int valid=0
  valid=!strcmp(scheme,"https")||(!strcmp(scheme,"http")&&cJSON_IsTrue(get(cfg,"allow_http"))&&(!strcmp(host,"localhost")||!strcmp(host,"127.0.0.1")||!strcmp(host,"[::1]")));
 done:curl_free(scheme);curl_free(host);curl_free(path);curl_url_cleanup(u);return valid;}
 static cJSON*claims_from(const cJSON*envelope){unsigned char raw[LIMIT+1];int n=b64(text(envelope,"payload"),raw,LIMIT);if(n<0)return NULL;raw[n]=0;return ln_json((char*)raw);}
-static int client_context(ln_client*c,const cJSON*envelope){cJSON*claims=claims_from(envelope);const cJSON*x=get(claims,"capabilities");int ok=1;if(x){const char*version=text(x,"app_version"),*expected=text(c->cfg,"app_version"),*model=text(x,"license_model");if(strcmp(version?version:"",expected?expected:""))ok=0;if(model&&!strcmp(model,"floating")&&(!text(x,"session_id")||strcmp(text(x,"session_id"),c->session)))ok=0;}cJSON_Delete(claims);return ok;}
+static int client_context(ln_client*c,const cJSON*envelope){cJSON*claims=claims_from(envelope);const cJSON*x=get(claims,"capabilities");int ok=1;const char*connection=text(c->cfg,"launch_connection_id"),*environment=text(c->cfg,"environment");if(!x&&connection&&connection[0])ok=0;if(x){const char*signed_connection=text(x,"launch_connection_id"),*signed_environment=text(x,"environment");if(strcmp(signed_connection?signed_connection:"",connection?connection:"")||strcmp(signed_environment?signed_environment:"",environment?environment:""))ok=0;const char*version=text(x,"app_version"),*expected=text(c->cfg,"app_version"),*model=text(x,"license_model");if(strcmp(version?version:"",expected?expected:""))ok=0;if(model&&!strcmp(model,"floating")&&(!text(x,"session_id")||strcmp(text(x,"session_id"),c->session)))ok=0;}cJSON_Delete(claims);return ok;}
 static int floating(ln_client*c){cJSON*claims=claims_from(c->cached);const char*model=text(get(claims,"capabilities"),"license_model");int result=model&&!strcmp(model,"floating");cJSON_Delete(claims);return result;}
-static int cache_valid(ln_client*c){return c->cached&&client_context(c,c->cached)&&(!c->wall||time(NULL)>=c->wall+(monotonic()-c->tick)-300)&&ln_verify(c->cached,get(c->cfg,"trusted_keys"),text(c->cfg,"product_id"),text(c->cfg,"device_id"),time(NULL));}
+static int source_hash(ln_client*c,char out[65]){const char*source=source_input(c);if(source&&source[0])return hash(source,out);const char*h=text(c->auth,"source_hash");if(!device(h))return 0;strcpy(out,h);return 1;}
+static int cache_valid(ln_client*c){return !is_denied(c)&&c->cached&&client_context(c,c->cached)&&(!c->wall||time(NULL)>=c->wall+(monotonic()-c->tick)-300)&&ln_verify(c->cached,get(c->cfg,"trusted_keys"),text(c->cfg,"product_id"),text(c->cfg,"device_id"),time(NULL));}
 static void view_lock(ln_client*c){
 #ifdef _WIN32
  EnterCriticalSection(&c->view_mutex);
@@ -214,7 +269,7 @@ static void view_unlock(ln_client*c){
 #endif
 }
 static void publish(ln_client*c,int online){view_lock(c);cJSON_Delete(c->view);c->view=cJSON_Duplicate(c->cached,1);c->view_wall=c->wall;c->view_tick=c->tick;c->view_online=online;snprintf(c->view_error.code,sizeof(c->view_error.code),"%s",c->error);snprintf(c->view_error.request_id,sizeof(c->view_error.request_id),"%s",c->request_id);c->view_error.http_status=(int)c->http_status;c->view_error.retryable=c->retryable;c->view_error.retry_after_seconds=c->retry_after;view_unlock(c);}
-static cJSON*local_claims(ln_client*c){view_lock(c);cJSON*envelope=cJSON_Duplicate(c->view,1);int64_t wall=c->view_wall;double tick=c->view_tick;view_unlock(c);int valid=envelope&&client_context(c,envelope)&&(!wall||time(NULL)>=wall+monotonic()-tick-300)&&ln_verify(envelope,get(c->cfg,"trusted_keys"),text(c->cfg,"product_id"),text(c->cfg,"device_id"),time(NULL));cJSON*claims=valid?claims_from(envelope):NULL;cJSON_Delete(envelope);return claims;}
+static cJSON*local_claims(ln_client*c){if(is_denied(c))return NULL;view_lock(c);cJSON*envelope=cJSON_Duplicate(c->view,1);int64_t wall=c->view_wall;double tick=c->view_tick;view_unlock(c);int valid=envelope&&client_context(c,envelope)&&(!wall||time(NULL)>=wall+monotonic()-tick-300)&&ln_verify(envelope,get(c->cfg,"trusted_keys"),text(c->cfg,"product_id"),text(c->cfg,"device_id"),time(NULL));cJSON*claims=valid?claims_from(envelope):NULL;cJSON_Delete(envelope);return claims;}
 int ln_get_error_info(ln_client*c,ln_error_info*out){if(!c||!out)return 0;view_lock(c);*out=c->view_error;view_unlock(c);return 1;}
 char*ln_status(ln_client*c){if(!c)return NULL;cJSON*claims=local_claims(c),*status=cJSON_CreateObject();view_lock(c);ln_error_info e=c->view_error;int online=c->view_online;view_unlock(c);const char*state=claims?(online?"active":"offline_valid"):"verification_required";if(!strcmp(e.code,"LICENSE_EXPIRED"))state="expired";if(!strcmp(e.code,"LICENSE_REVOKED")||!strcmp(e.code,"LICENSE_SUSPENDED"))state="revoked";if(!strcmp(e.code,"DEVICE_RELEASED")||!strcmp(e.code,"DEVICE_CREDENTIAL_REVOKED"))state="released";if(!strcmp(e.code,"FEATURE_QUOTA_EXCEEDED"))state="quota_exhausted";int64_t expires=0;num(claims,"expires_at",&expires);cJSON_AddStringToObject(status,"state",state);cJSON_AddBoolToObject(status,"allowed",claims!=NULL);cJSON_AddStringToObject(status,"code",e.code);cJSON_AddStringToObject(status,"request_id",e.request_id);cJSON_AddBoolToObject(status,"retryable",e.retryable);cJSON_AddNumberToObject(status,"lease_valid_until",(double)expires);char*out=cJSON_PrintUnformatted(status);cJSON_Delete(status);cJSON_Delete(claims);return out;}
 char*ln_feature_status(ln_client*c,const char*feature){
@@ -242,9 +297,9 @@ ln_client*ln_init(const char*config){if(!ensure_curl())return NULL;cJSON*cfg=ln_
 #ifdef _WIN32
  InitializeCriticalSection(&c->mutex);InitializeCriticalSection(&c->view_mutex);
 #else
- pthread_mutex_init(&c->mutex,NULL);pthread_mutex_init(&c->view_mutex,NULL);atomic_init(&c->stop,0);
+ pthread_mutex_init(&c->mutex,NULL);pthread_mutex_init(&c->view_mutex,NULL);atomic_init(&c->stop,0);atomic_init(&c->denied,0);
 #endif
- load_credential(c);if(!secret[0]&&!c->auth){ln_destroy(c);return NULL;}const char*path=text(cfg,"cache_path");char*b=path&&path[0]?readfile(path,LIMIT):NULL;if(b){cJSON*s=ln_json(b);int64_t version,observed;char h[65];int hash_ok=secret[0]?hash(secret,h):device(text(c->auth,"source_hash"));if(!secret[0]&&hash_ok)strcpy(h,text(c->auth,"source_hash"));if(hash_ok&&s&&num(s,"version",&version)&&version==1&&text(s,"license_hash")&&!strcmp(text(s,"license_hash"),h)&&num(s,"observed_at",&observed)&&time(NULL)+300>=observed&&ln_verify(get(s,"lease"),keys,text(cfg,"product_id"),text(cfg,"device_id"),time(NULL))){int interval=3600,mode=envelope_policy(get(s,"lease"),&interval);if(mode!=1&&client_context(c,get(s,"lease"))){c->cached=cJSON_Duplicate(get(s,"lease"),1);c->wall=observed;c->interval=interval;c->offline=mode;}}cJSON_Delete(s);free(b);}publish(c,0);return c;}
+ load_credential(c);load_logout_state(c);if(!source_input(c)[0]&&!c->auth&&!is_denied(c)){ln_destroy(c);return NULL;}const char*path=text(cfg,"cache_path");char*b=!is_denied(c)&&path&&path[0]?readfile(path,LIMIT):NULL;if(b){cJSON*s=ln_json(b);int64_t version,observed;char h[65];int hash_ok=source_hash(c,h);if(hash_ok&&s&&num(s,"version",&version)&&version==1&&text(s,"license_hash")&&!strcmp(text(s,"license_hash"),h)&&num(s,"observed_at",&observed)&&time(NULL)+300>=observed&&ln_verify(get(s,"lease"),keys,text(cfg,"product_id"),text(cfg,"device_id"),time(NULL))){int interval=3600,mode=envelope_policy(get(s,"lease"),&interval);if(mode!=1&&client_context(c,get(s,"lease"))){c->cached=cJSON_Duplicate(get(s,"lease"),1);c->wall=observed;c->interval=interval;c->offline=mode;}}cJSON_Delete(s);free(b);}publish(c,0);if(has_pending_logouts(c))ln_start_heartbeat(c);return c;}
 ln_client*ln_init_file(const char*p){char*b=readfile(p,LIMIT);if(!b)return NULL;ln_client*c=ln_init(b);free(b);return c;}
 ln_client*ln_init_product(const char*product_id,const char*trusted_keys_json,const char*license_key){
     if(!product_id||!trusted_keys_json||!license_key)return NULL;
@@ -272,38 +327,48 @@ ln_client*ln_init_file_with_license(const char*path,const char*license_key){
  ln_client*c=ln_init(b);free(b);return c;
 }
 const char*ln_last_error(const ln_client*c){return c?c->error:"INVALID_CONFIGURATION";}
-static void invalidate(ln_client*c){cJSON_Delete(c->cached);c->cached=NULL;c->offline=0;c->interval=3600;publish(c,0);const char*p=text(c->cfg,"cache_path");if(p&&p[0])remove(p);}
+static void invalidate(ln_client*c){cJSON_Delete(c->cached);c->cached=NULL;c->offline=0;c->interval=3600;publish(c,0);const char*p=text(c->cfg,"cache_path");if(p&&p[0]&&!is_denied(c))remove(p);}
 static void mkdirs(const char*p){char*copy=malloc(strlen(p)+1);if(!copy)return;strcpy(copy,p);for(char*s=copy+1;*s;s++)if(*s=='/'||*s=='\\'){char old=*s;*s=0;mkdir_private(copy);*s=old;}free(copy);}
 static int write_state(const char*p,const cJSON*s){
- char*b=cJSON_PrintUnformatted(s);char*tmp=malloc(strlen(p)+40);if(!tmp||!b){free(tmp);free(b);return 0;}unsigned char random[8];if(!random_bytes(random,8)){free(tmp);free(b);return 0;}sprintf(tmp,"%s.%02x%02x%02x%02x.tmp",p,random[0],random[1],random[2],random[3]);mkdirs(p);FILE*f=fopen(tmp,"wb");int ok=0;if(f){
+ char*b=cJSON_PrintUnformatted(s);char*tmp=malloc(strlen(p)+40);if(!tmp||!b){free(tmp);free(b);return 0;}unsigned char random[8];if(!random_bytes(random,8)){free(tmp);free(b);return 0;}
+ /* Keep temporary filenames short even when a task journal has a long name. */
+ const char*slash=strrchr(p,'/'),*backslash=strrchr(p,'\\');if(backslash&&(!slash||backslash>slash))slash=backslash;size_t prefix=slash?(size_t)(slash-p)+1:0;memcpy(tmp,p,prefix);sprintf(tmp+prefix,".state-%02x%02x%02x%02x%02x%02x%02x%02x.tmp",random[0],random[1],random[2],random[3],random[4],random[5],random[6],random[7]);mkdirs(p);FILE*f=fopen(tmp,"wb");int ok=0;if(f){
 #ifndef _WIN32
  fchmod(fileno(f),0600);
 #endif
- ok=fwrite(b,1,strlen(b),f)==strlen(b);if(fclose(f))ok=0;
+ ok=fwrite(b,1,strlen(b),f)==strlen(b);if(fflush(f))ok=0;
+#ifdef _WIN32
+ if(ok&&_commit(_fileno(f)))ok=0;
+#else
+ if(ok&&fsync(fileno(f)))ok=0;
+#endif
+ if(fclose(f))ok=0;
 #ifdef _WIN32
- if(ok)ok=MoveFileExA(tmp,p,MOVEFILE_REPLACE_EXISTING|MOVEFILE_WRITE_THROUGH)!=0;
+ if(ok)ok=state_windows_move(tmp,p);
 #else
  if(ok)ok=rename(tmp,p)==0;
 #endif
  }remove(tmp);free(tmp);free(b);return ok;
 }
-static int save(ln_client*c){const char*p=text(c->cfg,"cache_path");if(!p||!p[0])return 1;char h[65];if(!text(c->cfg,"license_key")[0])strcpy(h,text(c->auth,"source_hash"));else if(!hash(text(c->cfg,"license_key"),h))return 0;cJSON*s=cJSON_CreateObject();cJSON_AddNumberToObject(s,"version",1);cJSON_AddStringToObject(s,"license_hash",h);cJSON_AddItemToObject(s,"lease",cJSON_Duplicate(c->cached,1));cJSON_AddNumberToObject(s,"observed_at",(double)c->wall);int ok=write_state(p,s);cJSON_Delete(s);return ok;}
+static int save(ln_client*c){const char*p=text(c->cfg,"cache_path");if(!p||!p[0])return 1;char h[65];if(!source_hash(c,h))return 0;cJSON*s=cJSON_CreateObject();cJSON_AddNumberToObject(s,"version",1);cJSON_AddStringToObject(s,"license_hash",h);cJSON_AddItemToObject(s,"lease",cJSON_Duplicate(c->cached,1));cJSON_AddNumberToObject(s,"observed_at",(double)c->wall);int ok=write_state(p,s);cJSON_Delete(s);return ok;}
 static char*credential_path(ln_client*c){const char*p=text(c->cfg,"cache_path");if(!p||!p[0])return NULL;char*out=malloc(strlen(p)+18);if(out)sprintf(out,"%s.credential.json",p);return out;}
 static void load_credential(ln_client*c){
  
- char*p=credential_path(c);if(!p)return;char*b=readfile(p,LIMIT);free(p);if(!b)return;cJSON*s=ln_json(b);free(b);char h[65];int64_t version;int ok=hash(text(c->cfg,"license_key"),h)&&s&&num(s,"version",&version)&&version==1&&text(s,"origin")&&!strcmp(text(s,"origin"),text(c->cfg,"base_url"))&&device(text(s,"source_hash"))&&(!text(c->cfg,"license_key")[0]||!strcmp(text(s,"source_hash"),h))&&uuid(text(s,"request_id"))&&uuid(text(s,"session_id"));
+ char*p=credential_path(c);if(!p)return;char*b=readfile(p,LIMIT);free(p);if(!b)return;cJSON*s=ln_json(b);free(b);char h[65];int64_t version;int ok=hash(source_input(c),h)&&s&&num(s,"version",&version)&&version==1&&text(s,"origin")&&!strcmp(text(s,"origin"),text(c->cfg,"base_url"))&&device(text(s,"source_hash"))&&(!source_input(c)[0]||!strcmp(text(s,"source_hash"),h))&&uuid(text(s,"request_id"))&&uuid(text(s,"session_id"));
  const char*ctx[]={"product_id","device_id"};for(int i=0;i<2;i++){const char*a=text(s,ctx[i]),*b=text(c->cfg,ctx[i]);if(!a||!b||strcmp(a,b))ok=0;}const char*k=text(s,"device_key");if(!k||(k[0]&&!credential_secret(k,"lv_dev_"))||(!text(c->cfg,"license_key")[0]&&!k[0]))ok=0;
  if(ok){c->auth=s;if(!k[0])strcpy(c->session,text(s,"session_id"));}else cJSON_Delete(s);
 }
 static int save_credential(ln_client*c){char*p=credential_path(c);if(!p){strcpy(c->error,"CREDENTIAL_PATH_REQUIRED");return 0;}int ok=write_state(p,c->auth);free(p);if(ok)c->auth_dirty=0;else strcpy(c->error,"CREDENTIAL_WRITE_FAILED");return ok;}
 static int prepare_credential(ln_client*c){
- if(!temporary(c))return 1;
- if(!c->auth){char h[65],id[37];if(!hash(text(c->cfg,"license_key"),h)||!request_uuid(id))return 0;c->auth=cJSON_CreateObject();cJSON_AddNumberToObject(c->auth,"version",1);cJSON_AddStringToObject(c->auth,"origin",text(c->cfg,"base_url"));cJSON_AddStringToObject(c->auth,"source_hash",h);cJSON_AddStringToObject(c->auth,"product_id",text(c->cfg,"product_id"));cJSON_AddStringToObject(c->auth,"device_id",text(c->cfg,"device_id"));cJSON_AddStringToObject(c->auth,"device_key","");cJSON_AddStringToObject(c->auth,"request_id",id);cJSON_AddStringToObject(c->auth,"session_id",c->session);c->auth_dirty=1;}
+ if(is_denied(c)){strcpy(c->error,"LAUNCH_LOGIN_REQUIRED");return 0;}if(!temporary(c))return 1;
+ if(!c->auth){char h[65],id[37];if(!source_hash(c,h)||!request_uuid(id))return 0;c->auth=cJSON_CreateObject();cJSON_AddNumberToObject(c->auth,"version",1);cJSON_AddStringToObject(c->auth,"origin",text(c->cfg,"base_url"));cJSON_AddStringToObject(c->auth,"source_hash",h);cJSON_AddStringToObject(c->auth,"product_id",text(c->cfg,"product_id"));cJSON_AddStringToObject(c->auth,"device_id",text(c->cfg,"device_id"));cJSON_AddStringToObject(c->auth,"device_key","");cJSON_AddStringToObject(c->auth,"request_id",id);cJSON_AddStringToObject(c->auth,"session_id",c->session);c->auth_dirty=1;}
  return !c->auth_dirty||save_credential(c);
 }
 static int accept_credential(ln_client*c,const cJSON*result){
- if(!temporary(c)||(text(c->auth,"device_key")&&text(c->auth,"device_key")[0]))return 1;
- const char*k=text(result,"device_key");if(!credential_secret(k,"lv_dev_")){if(strncmp(text(c->cfg,"license_key"),"lv_tmp_",7))return 1;strcpy(c->error,"DEVICE_CREDENTIAL_MISSING");return 0;}if(!prepare_credential(c))return 0;cJSON_ReplaceItemInObjectCaseSensitive(c->auth,"device_key",cJSON_CreateString(k));c->auth_dirty=1;return save_credential(c);
+ if(logout_binding_blocked(c,result))return 0;
+ if(cJSON_IsTrue(get(c->logout_state,"signed_out"))){cJSON_ReplaceItemInObjectCaseSensitive(c->logout_state,"signed_out",cJSON_CreateBool(0));if(!save_logout_state(c))return 0;}
+ if(get(result,"logout_ticket")){if(!prepare_credential(c))return 0;cJSON_DeleteItemFromObjectCaseSensitive(c->auth,"logout_ticket");cJSON_AddItemToObject(c->auth,"logout_ticket",cJSON_Duplicate(get(result,"logout_ticket"),1));c->auth_dirty=1;if(!save_credential(c))return 0;}if(!temporary(c)||(text(c->auth,"device_key")&&text(c->auth,"device_key")[0]))return 1;
+ const char*k=text(result,"device_key");if(!credential_secret(k,"lv_dev_")){if(strncmp(text(c->cfg,"license_key"),"lv_tmp_",7)&&!(text(c->cfg,"identity_token")&&text(c->cfg,"identity_token")[0]))return 1;strcpy(c->error,"DEVICE_CREDENTIAL_MISSING");return 0;}if(!prepare_credential(c))return 0;cJSON_ReplaceItemInObjectCaseSensitive(c->auth,"device_key",cJSON_CreateString(k));c->auth_dirty=1;return save_credential(c);
 }
 struct buffer{char data[LIMIT+1];size_t size;int oversized;};
 static size_t receive(void*data,size_t size,size_t n,void*arg){struct buffer*b=arg;size_t amount=size*n;if(amount>LIMIT-b->size){b->oversized=1;return 0;}memcpy(b->data+b->size,data,amount);b->size+=amount;b->data[b->size]=0;return amount;}
@@ -315,19 +380,20 @@ static void sleepms(int ms){
 #endif
 }
 static size_t receive_header(char*data,size_t size,size_t n,void*arg){size_t length=size*n;ln_client*c=arg;if(length>12&&!strncmp(data,"Retry-After:",12)){char value[32];size_t count=length-12;if(count>31)count=31;memcpy(value,data+12,count);value[count]=0;long seconds=strtol(value,NULL,10);if(seconds>0)c->retry_after=seconds>86400?86400:(int)seconds;}return length;}
-static cJSON*request_extra(ln_client*c,const char*op,const char*activation,int*transient,const char*operation_id,const cJSON*extra){*transient=0;c->error[0]=0;c->request_id[0]=0;c->retryable=0;c->http_status=0;c->retry_after=0;if(!prepare_credential(c))return NULL;if(!strcmp(op,"activate")&&temporary(c)&&!text(c->auth,"device_key")[0]&&!c->cached)operation_id=text(c->auth,"request_id");unsigned char random[16];if(!random_bytes(random,16)){strcpy(c->error,"RANDOM_SOURCE_FAILED");return NULL;}char idem[120]="Idempotency-Key: ";size_t used=strlen(idem);for(int i=0;i<16;i++)sprintf(idem+used+i*2,"%02x",random[i]);if(operation_id){if(strlen(operation_id)>80||strpbrk(operation_id," \t\r\n")){strcpy(c->error,"INVALID_OPERATION_ID");return NULL;}snprintf(idem,sizeof(idem),"Idempotency-Key: %s",operation_id);}cJSON*body=cJSON_CreateObject();const char*names[]={"product_id","license_key","device_id","device_name","app_version"};for(int i=0;i<5;i++){const char*s=text(c->cfg,names[i]);cJSON_AddStringToObject(body,names[i],s?s:"");}cJSON_ReplaceItemInObjectCaseSensitive(body,"license_key",cJSON_CreateString(runtime_key(c)));cJSON_AddStringToObject(body,"activation_id",activation);cJSON_AddStringToObject(body,"session_id",c->session);cJSON_AddItemToObject(body,"device_profile",cJSON_Duplicate(get(c->cfg,"device_profile"),1));if(extra)for(const cJSON*x=extra->child;x;x=x->next)cJSON_AddItemToObject(body,x->string,cJSON_Duplicate(x,1));char*json=cJSON_PrintUnformatted(body);cJSON_Delete(body);const char*base=text(c->cfg,"base_url");char*url=malloc(strlen(base)+strlen(op)+20);if(!url||!json){free(url);free(json);return NULL;}strcpy(url,base);size_t len=strlen(url);if(len&&url[len-1]=='/')url[len-1]=0;strcat(url,"/api/v1/");strcat(url,op);struct curl_slist*headers=NULL;headers=curl_slist_append(headers,"Content-Type: application/json");headers=curl_slist_append(headers,idem);cJSON*result=NULL;
+static cJSON*request_extra(ln_client*c,const char*op,const char*activation,int*transient,const char*operation_id,const cJSON*extra){*transient=0;c->error[0]=0;c->request_id[0]=0;c->retryable=0;c->http_status=0;c->retry_after=0;if(!prepare_credential(c))return NULL;if(!strcmp(op,"activate")&&temporary(c)&&!text(c->auth,"device_key")[0]&&!c->cached)operation_id=text(c->auth,"request_id");unsigned char random[16];if(!random_bytes(random,16)){strcpy(c->error,"RANDOM_SOURCE_FAILED");return NULL;}char idem[120]="Idempotency-Key: ";size_t used=strlen(idem);for(int i=0;i<16;i++)sprintf(idem+used+i*2,"%02x",random[i]);if(operation_id){if(strlen(operation_id)>80||strpbrk(operation_id," \t\r\n")){strcpy(c->error,"INVALID_OPERATION_ID");return NULL;}snprintf(idem,sizeof(idem),"Idempotency-Key: %s",operation_id);}cJSON*body=cJSON_CreateObject();const char*names[]={"product_id","license_key","device_id","device_name","app_version"};for(int i=0;i<5;i++){const char*s=text(c->cfg,names[i]);cJSON_AddStringToObject(body,names[i],s?s:"");}cJSON_ReplaceItemInObjectCaseSensitive(body,"license_key",cJSON_CreateString(runtime_key(c)));cJSON_AddStringToObject(body,"activation_id",activation);cJSON_AddStringToObject(body,"session_id",c->session);cJSON_AddItemToObject(body,"device_profile",cJSON_Duplicate(get(c->cfg,"device_profile"),1));if(extra)for(const cJSON*x=extra->child;x;x=x->next)cJSON_AddItemToObject(body,x->string,cJSON_Duplicate(x,1));if(!get(c->auth,"logout_ticket"))cJSON_AddBoolToObject(body,"request_logout_ticket",1);if(text(c->cfg,"launch_connection_id")){cJSON_AddStringToObject(body,"launch_connection_id",text(c->cfg,"launch_connection_id"));cJSON_AddStringToObject(body,"environment",text(c->cfg,"environment")?text(c->cfg,"environment"):"");}if(!runtime_key(c)[0]&&text(c->cfg,"identity_token")){const char*identity_names[]={"identity_token","launch_connection_id","environment"};for(int i=0;i<3;i++){const char*v=text(c->cfg,identity_names[i]);cJSON_DeleteItemFromObjectCaseSensitive(body,identity_names[i]);cJSON_AddStringToObject(body,identity_names[i],v?v:"");}op="launch/exchange";}char*json=cJSON_PrintUnformatted(body);cJSON_Delete(body);const char*base=text(c->cfg,"base_url");char*url=malloc(strlen(base)+strlen(op)+20);if(!url||!json){free(url);free(json);return NULL;}strcpy(url,base);size_t len=strlen(url);if(len&&url[len-1]=='/')url[len-1]=0;strcat(url,"/api/v1/");strcat(url,op);struct curl_slist*headers=NULL;headers=curl_slist_append(headers,"Content-Type: application/json");headers=curl_slist_append(headers,idem);cJSON*result=NULL;
  for(int attempt=0;attempt<2;attempt++){if(attempt)sleepms(200);struct buffer b={{0},0,0};CURL*curl=curl_easy_init();if(!curl)break;curl_easy_setopt(curl,CURLOPT_URL,url);curl_easy_setopt(curl,CURLOPT_POSTFIELDS,json);curl_easy_setopt(curl,CURLOPT_HTTPHEADER,headers);curl_easy_setopt(curl,CURLOPT_WRITEFUNCTION,receive);curl_easy_setopt(curl,CURLOPT_WRITEDATA,&b);int64_t timeout=10;num(c->cfg,"timeout_seconds",&timeout);curl_easy_setopt(curl,CURLOPT_TIMEOUT,(long)timeout);const char*proxy=text(c->cfg,"proxy_url");if(proxy&&proxy[0])curl_easy_setopt(curl,CURLOPT_PROXY,proxy);curl_easy_setopt(curl,CURLOPT_HEADERFUNCTION,receive_header);curl_easy_setopt(curl,CURLOPT_HEADERDATA,c);curl_easy_setopt(curl,CURLOPT_CONNECTTIMEOUT,5L);curl_easy_setopt(curl,CURLOPT_NOSIGNAL,1L);curl_easy_setopt(curl,CURLOPT_FOLLOWLOCATION,0L);curl_easy_setopt(curl,CURLOPT_SSL_VERIFYPEER,1L);curl_easy_setopt(curl,CURLOPT_SSL_VERIFYHOST,2L);const char*ca=getenv("LICENTIVO_CA_BUNDLE");if(ca&&ca[0])curl_easy_setopt(curl,CURLOPT_CAINFO,ca);CURLcode err=curl_easy_perform(curl);long status=0;curl_easy_getinfo(curl,CURLINFO_RESPONSE_CODE,&status);curl_easy_cleanup(curl);if(b.oversized){strcpy(c->error,"RESPONSE_TOO_LARGE");*transient=0;break;}c->http_status=status;if(err!=CURLE_OK){*transient=1;c->retryable=1;strcpy(c->error,"SERVER_UNAVAILABLE");continue;}*transient=0;if(memchr(b.data,0,b.size)){strcpy(c->error,"INVALID_JSON");break;}cJSON*env=ln_json(b.data);if(!env){strcpy(c->error,"UNEXPECTED_RESPONSE");c->retryable=status==429||status>=500;*transient=c->retryable;if(c->retry_after>0)c->retry_at=(int64_t)time(NULL)+c->retry_after;if(status>=500)continue;break;}const char*trace=text(env,"request_id");snprintf(c->request_id,sizeof(c->request_id),"%s",trace?trace:"");if(status!=200||get(env,"error")){const char*code=text(get(env,"error"),"code");snprintf(c->error,sizeof(c->error),"%s",code?code:"UNEXPECTED_RESPONSE");c->retryable=status==429||status>=500;*transient=c->retryable;if(c->retry_after>0)c->retry_at=(int64_t)time(NULL)+c->retry_after;cJSON_Delete(env);if(status>=500)continue;break;}result=cJSON_Duplicate(get(env,"data"),1);cJSON_Delete(env);break;}
- curl_slist_free_all(headers);free(url);free(json);return result;
+ curl_slist_free_all(headers);free(url);free(json);if(!result&&revocation_error(c->error))deny_runtime(c);return result;
 }
 static cJSON*request(ln_client*c,const char*op,const char*activation,int*transient){return request_extra(c,op,activation,transient,NULL,NULL);}
+#include "device_logout.h"
 static char*activation_id(ln_client*c){if(!c->cached)return NULL;unsigned char raw[LIMIT+1];int n=b64(text(c->cached,"payload"),raw,LIMIT);if(n<0)return NULL;raw[n]=0;cJSON*claims=ln_json((char*)raw);const char*s=text(claims,"activation_id");char*out=s?malloc(strlen(s)+1):NULL;if(out)strcpy(out,s);cJSON_Delete(claims);return out;}
-static int call(ln_client*c,const char*op,int force_online){if(!c)return 0;lock(c);if(!force_online&&!strcmp(op,"activate")&&c->offline==2&&c->interval==0&&cache_valid(c)){unlock(c);return 1;}char*id=NULL;if(strcmp(op,"activate")){id=activation_id(c);if(!id){strcpy(c->error,"ACTIVATE_FIRST");unlock(c);return 0;}}int temporary=0;cJSON*data=request(c,op,id?id:"",&temporary);free(id);if(!data){int ok=!force_online&&temporary&&c->offline!=1&&cache_valid(c);if(!temporary||c->offline==1)invalidate(c);publish(c,0);unlock(c);notify(c);return ok;}
- const cJSON*e=get(data,"lease");int ok=client_context(c,e)&&ln_verify(e,get(c->cfg,"trusted_keys"),text(c->cfg,"product_id"),text(c->cfg,"device_id"),time(NULL));if(ok){cJSON_Delete(c->cached);c->cached=cJSON_Duplicate(e,1);char*activation=activation_id(c);const char*expected=text(data,"activation_id");ok=activation&&expected&&!strcmp(activation,expected);free(activation);}if(ok){c->wall=time(NULL);c->tick=monotonic();int64_t interval;if(num(data,"heartbeat_seconds",&interval)&&interval>=10&&interval<=86400)c->interval=(int)interval;c->offline=envelope_policy(c->cached,&c->interval);ok=accept_credential(c,data)&&save(c);if(ok)c->error[0]=0;else if(c->error[0]==0)strcpy(c->error,"CACHE_WRITE_FAILED");}else{strcpy(c->error,"INVALID_LEASE");invalidate(c);}cJSON_Delete(data);publish(c,ok);unlock(c);notify(c);return ok;}
+static int call(ln_client*c,const char*op,int force_online){if(!c)return 0;lock(c);if(is_denied(c)){strcpy(c->error,"LAUNCH_LOGIN_REQUIRED");unlock(c);return 0;}if(!force_online&&!strcmp(op,"activate")&&c->offline==2&&c->interval==0&&cache_valid(c)){unlock(c);return 1;}char*id=NULL;if(strcmp(op,"activate")){id=activation_id(c);if(!id){strcpy(c->error,"ACTIVATE_FIRST");unlock(c);return 0;}}int temporary=0;cJSON*data=request(c,op,id?id:"",&temporary);free(id);if(!data){int ok=!force_online&&temporary&&c->offline!=1&&cache_valid(c);if(!temporary||c->offline==1)invalidate(c);publish(c,0);unlock(c);notify(c);return ok;}
+ if(is_denied(c)){if(c->auth&&get(data,"logout_ticket")){cJSON_DeleteItemFromObjectCaseSensitive(c->auth,"logout_ticket");cJSON_AddItemToObject(c->auth,"logout_ticket",cJSON_Duplicate(get(data,"logout_ticket"),1));}cJSON_Delete(data);unlock(c);return 0;}const cJSON*e=get(data,"lease");int ok=client_context(c,e)&&ln_verify(e,get(c->cfg,"trusted_keys"),text(c->cfg,"product_id"),text(c->cfg,"device_id"),time(NULL));if(ok){cJSON_Delete(c->cached);c->cached=cJSON_Duplicate(e,1);char*activation=activation_id(c);const char*expected=text(data,"activation_id");ok=activation&&expected&&!strcmp(activation,expected);free(activation);}if(ok){c->wall=time(NULL);c->tick=monotonic();int64_t interval;if(num(data,"heartbeat_seconds",&interval)&&interval>=10&&interval<=86400)c->interval=(int)interval;c->offline=envelope_policy(c->cached,&c->interval);ok=accept_credential(c,data)&&save(c);if(ok)c->error[0]=0;else if(c->error[0]==0)strcpy(c->error,"CACHE_WRITE_FAILED");}else{strcpy(c->error,"INVALID_LEASE");invalidate(c);}cJSON_Delete(data);publish(c,ok);unlock(c);notify(c);return ok;}
 int ln_activate(ln_client*c){return call(c,"activate",0);}int ln_validate(ln_client*c){return call(c,"validate",0);}int ln_heartbeat(ln_client*c){return call(c,"heartbeat",0);}
 int ln_check_feature(ln_client*c,const char*feature){if(!c||!feature)return 0;cJSON*claims=local_claims(c);int ok=0;const cJSON*fs=get(claims,"features");for(const cJSON*f=fs?fs->child:NULL;f;f=f->next)if(cJSON_IsString(f)&&!strcmp(f->valuestring,feature))ok=1;cJSON_Delete(claims);return ok;}
 int ln_run_feature(ln_client*c,const char*feature,ln_feature_action action,void*context){if(!action||!ln_check_feature(c,feature))return 0;return action(context)!=0;}
 int ln_refresh_online(ln_client*c){return call(c,"activate",1);}
-int ln_deactivate(ln_client*c){if(!c)return 0;lock(c);int is_floating=floating(c);char*id=activation_id(c);invalidate(c);int ok=1;if(id){int temp;cJSON*result=request(c,"deactivate",id,&temp);ok=result!=NULL;cJSON_Delete(result);free(id);}if(ok&&!is_floating){char*path=credential_path(c);if(path){remove(path);free(path);}cJSON_Delete(c->auth);c->auth=NULL;strcpy(c->error,"DEVICE_RELEASED");}publish(c,0);unlock(c);notify(c);return ok;}
+int ln_deactivate(ln_client*c){return ln_logout(c);}
 static int stopped(ln_client*c){
 #ifdef _WIN32
  return InterlockedCompareExchange(&c->stop,0,0)!=0;
@@ -340,7 +406,7 @@ static DWORD WINAPI heartbeat_run(LPVOID arg){
 #else
 static void*heartbeat_run(void*arg){
 #endif
- ln_client*c=arg;lock(c);int refresh=c->refresh_pending;c->refresh_pending=0;unlock(c);if(refresh&&!stopped(c))ln_refresh_online(c);while(!stopped(c)){unsigned char r=0;random_bytes(&r,1);lock(c);double wait=(c->interval<600?600:c->interval)*(1+r/255.0*.1);double retry=(double)c->retry_at-time(NULL);if(retry>wait)wait=retry;int disabled=c->interval==0;unlock(c);if(disabled)break;double end=monotonic()+wait;while(!stopped(c)&&monotonic()<end)sleepms(100);if(!stopped(c))ln_heartbeat(c);}lock(c);c->finished=1;unlock(c);return 0;}
+ ln_client*c=arg;lock(c);int refresh=c->refresh_pending;c->refresh_pending=0;unlock(c);if(refresh&&!stopped(c))ln_refresh_online(c);while(!stopped(c)){unsigned char r=0;random_bytes(&r,1);lock(c);double wait=has_pending_logouts(c)?2:(c->interval<600?600:c->interval)*(1+r/255.0*.1);double retry=(double)c->retry_at-time(NULL);if(retry>wait)wait=retry;int disabled=(c->interval==0||is_denied(c))&&!has_pending_logouts(c);unlock(c);if(disabled)break;double end=monotonic()+wait;while(!stopped(c)&&monotonic()<end)sleepms(100);if(!stopped(c)){if(is_denied(c)||ln_logout_pending(c))ln_retry_pending_logouts(c);if(!is_denied(c))ln_heartbeat(c);}}lock(c);c->finished=1;unlock(c);return 0;}
 int ln_start_heartbeat(ln_client*c){if(!c)return 0;if(c->started){lock(c);int finished=c->finished;unlock(c);if(!finished)return 1;ln_stop_heartbeat(c);}lock(c);int disabled=c->interval==0;c->finished=0;unlock(c);if(disabled&&!c->refresh_pending)return 1;
 #ifdef _WIN32
  InterlockedExchange(&c->stop,0);c->thread=CreateThread(NULL,0,heartbeat_run,c,0,NULL);if(!c->thread)return 0;
@@ -355,7 +421,7 @@ void ln_stop_heartbeat(ln_client*c){if(!c||!c->started)return;
  atomic_store(&c->stop,1);pthread_join(c->thread,NULL);
 #endif
  c->started=0;}
-void ln_destroy(ln_client*c){if(!c)return;ln_stop_heartbeat(c);if(floating(c))ln_deactivate(c);cJSON_Delete(c->cfg);cJSON_Delete(c->cached);cJSON_Delete(c->auth);cJSON_Delete(c->view);
+void ln_destroy(ln_client*c){if(!c)return;ln_stop_heartbeat(c);if(floating(c)&&!is_denied(c)){char*id=activation_id(c);if(id){int transient;cJSON*result=request(c,"deactivate",id,&transient);cJSON_Delete(result);free(id);}}cJSON_Delete(c->logout_bindings);cJSON_Delete(c->logout_state);cJSON_Delete(c->cfg);cJSON_Delete(c->cached);cJSON_Delete(c->auth);cJSON_Delete(c->view);
 #ifdef _WIN32
  DeleteCriticalSection(&c->mutex);DeleteCriticalSection(&c->view_mutex);
 #else
@@ -363,13 +429,13 @@ void ln_destroy(ln_client*c){if(!c)return;ln_stop_heartbeat(c);if(floating(c))ln
 #endif
  free(c);}
 
-int ln_start(ln_client*c){if(!c)return 0;lock(c);int fast=cache_valid(c)&&c->offline!=1&&!floating(c);if(fast)c->refresh_pending=1;unlock(c);return (fast||ln_activate(c))&&ln_start_heartbeat(c);}
+int ln_start(ln_client*c){if(!c)return 0;if(is_denied(c)&&ln_logout_pending(c))ln_retry_pending_logouts(c);lock(c);int fast=cache_valid(c)&&c->offline!=1&&!floating(c);if(fast)c->refresh_pending=1;unlock(c);return (fast||ln_activate(c))&&ln_start_heartbeat(c);}
 ln_client*ln_open(const char*path){ln_client*c=ln_init_file(path);if(c&&!ln_start(c)){ln_destroy(c);return NULL;}return c;}
 ln_client*ln_open_with_license(const char*path,const char*license_key){ln_client*c=ln_init_file_with_license(path,license_key);if(c&&!ln_start(c)){ln_destroy(c);return NULL;}return c;}
 void ln_free_string(char*s){free(s);}
 char*ln_consume(ln_client*c,const char*feature,int64_t quantity,const char*operation_id){if(!c||!feature||!operation_id||!operation_id[0])return NULL;lock(c);if(!cache_valid(c)){strcpy(c->error,"LICENSE_CHECK_REQUIRED");unlock(c);return NULL;}char*activation=activation_id(c);cJSON*extra=cJSON_CreateObject();cJSON_AddStringToObject(extra,"feature",feature);cJSON_AddNumberToObject(extra,"quantity",(double)quantity);int transient=0;cJSON*result=request_extra(c,"consume",activation,&transient,operation_id,extra);char*out=result?cJSON_PrintUnformatted(get(result,"consumption")):NULL;cJSON_Delete(extra);free(activation);if(!result&&(!strcmp(c->error,"LICENSE_REVOKED")||!strcmp(c->error,"LICENSE_SUSPENDED")||!strcmp(c->error,"DEVICE_RELEASED")||!strcmp(c->error,"DEVICE_CREDENTIAL_REVOKED")||!strcmp(c->error,"LICENSE_EXPIRED")))invalidate(c);int success=result!=NULL;cJSON_Delete(result);publish(c,success);unlock(c);notify(c);return out;}
-char*ln_offline_request(ln_client*c,const char*operation){if(!c||!operation||(strcmp(operation,"activate")&&strcmp(operation,"deactivate")))return NULL;lock(c);if(!prepare_credential(c)){unlock(c);return NULL;}char*activation=NULL;if(!strcmp(operation,"deactivate")){if(!cache_valid(c)){unlock(c);return NULL;}activation=activation_id(c);invalidate(c);}char id[37];if(!request_uuid(id)){free(activation);unlock(c);return NULL;}cJSON*body=cJSON_CreateObject();const char*names[]={"product_id","license_key","device_id","device_name","app_version"};for(int i=0;i<5;i++){const char*v=text(c->cfg,names[i]);cJSON_AddStringToObject(body,names[i],v?v:"");}cJSON_ReplaceItemInObjectCaseSensitive(body,"license_key",cJSON_CreateString(runtime_key(c)));cJSON_AddStringToObject(body,"activation_id",activation?activation:"");cJSON_AddStringToObject(body,"session_id",c->session);cJSON_AddItemToObject(body,"device_profile",cJSON_Duplicate(get(c->cfg,"device_profile"),1));cJSON_AddNumberToObject(body,"version",1);cJSON_AddStringToObject(body,"request_id",id);cJSON_AddNumberToObject(body,"created_at",(double)time(NULL));cJSON_AddStringToObject(body,"operation",operation);char*out=cJSON_PrintUnformatted(body);cJSON_Delete(body);free(activation);unlock(c);return out;}
-int ln_import_offline(ln_client*c,const char*request_json,const char*response_json){if(!c||!request_json||!response_json||strlen(request_json)>LIMIT||strlen(response_json)>LIMIT)return 0;lock(c);cJSON*req=ln_json(request_json),*res=ln_json(response_json);int64_t version=0;int ok=req&&res&&num(res,"version",&version)&&version==1;const char*fields[]={"request_id","operation"};for(int i=0;i<2;i++){const char*a=text(req,fields[i]),*b=text(res,fields[i]);if(!a||!b||strcmp(a,b))ok=0;}if(!text(req,"operation")||strcmp(text(req,"operation"),"activate"))ok=0;const char*context[]={"product_id","device_id","license_key"};for(int i=0;i<3;i++){const char*a=text(req,context[i]),*b=!strcmp(context[i],"license_key")?runtime_key(c):text(c->cfg,context[i]);if(!a||!b||strcmp(a,b))ok=0;}
+char*ln_offline_request(ln_client*c,const char*operation){if(!c||is_denied(c)||!operation||(strcmp(operation,"activate")&&strcmp(operation,"deactivate")))return NULL;lock(c);if(!prepare_credential(c)){unlock(c);return NULL;}char*activation=NULL;if(!strcmp(operation,"deactivate")){if(!cache_valid(c)){unlock(c);return NULL;}activation=activation_id(c);invalidate(c);}char id[37];if(!request_uuid(id)){free(activation);unlock(c);return NULL;}cJSON*body=cJSON_CreateObject();const char*names[]={"product_id","license_key","device_id","device_name","app_version"};for(int i=0;i<5;i++){const char*v=text(c->cfg,names[i]);cJSON_AddStringToObject(body,names[i],v?v:"");}cJSON_ReplaceItemInObjectCaseSensitive(body,"license_key",cJSON_CreateString(runtime_key(c)));cJSON_AddStringToObject(body,"activation_id",activation?activation:"");cJSON_AddStringToObject(body,"session_id",c->session);cJSON_AddItemToObject(body,"device_profile",cJSON_Duplicate(get(c->cfg,"device_profile"),1));cJSON_AddBoolToObject(body,"request_logout_ticket",1);cJSON_AddNumberToObject(body,"version",1);cJSON_AddStringToObject(body,"request_id",id);cJSON_AddNumberToObject(body,"created_at",(double)time(NULL));cJSON_AddStringToObject(body,"operation",operation);char*out=cJSON_PrintUnformatted(body);cJSON_Delete(body);free(activation);unlock(c);return out;}
+int ln_import_offline(ln_client*c,const char*request_json,const char*response_json){if(!c||is_denied(c)||!request_json||!response_json||strlen(request_json)>LIMIT||strlen(response_json)>LIMIT)return 0;lock(c);cJSON*req=ln_json(request_json),*res=ln_json(response_json);int64_t version=0;int ok=req&&res&&num(res,"version",&version)&&version==1;const char*fields[]={"request_id","operation"};for(int i=0;i<2;i++){const char*a=text(req,fields[i]),*b=text(res,fields[i]);if(!a||!b||strcmp(a,b))ok=0;}if(!text(req,"operation")||strcmp(text(req,"operation"),"activate"))ok=0;const char*context[]={"product_id","device_id","license_key"};for(int i=0;i<3;i++){const char*a=text(req,context[i]),*b=!strcmp(context[i],"license_key")?runtime_key(c):text(c->cfg,context[i]);if(!a||!b||strcmp(a,b))ok=0;}
  const cJSON*result=get(res,"result"),*envelope=get(result,"lease");if(!client_context(c,envelope)||!ln_verify(envelope,get(c->cfg,"trusted_keys"),text(c->cfg,"product_id"),text(c->cfg,"device_id"),time(NULL)))ok=0;cJSON*claims=claims_from(envelope);const char*id=text(claims,"offline_request_id"),*expected=text(req,"request_id"),*activation=text(claims,"activation_id"),*response_id=text(result,"activation_id");if(!id||!expected||strcmp(id,expected)||!activation||!response_id||strcmp(activation,response_id)||envelope_policy(envelope,NULL)==1)ok=0;
  if(ok){cJSON_Delete(c->cached);c->cached=cJSON_Duplicate(envelope,1);c->wall=time(NULL);c->tick=monotonic();c->offline=envelope_policy(c->cached,&c->interval);ok=accept_credential(c,result)&&save(c);}if(!ok)strcpy(c->error,"INVALID_OFFLINE_RESPONSE");cJSON_Delete(claims);cJSON_Delete(req);cJSON_Delete(res);publish(c,0);unlock(c);notify(c);return ok;
 }

data/vendor/c/licentivo.h

@@ -53,6 +53,10 @@ int ln_heartbeat(ln_client *client);
 int ln_refresh_online(ln_client *client);
 int ln_check_feature(ln_client *client,const char *feature);
 int ln_deactivate(ln_client *client);
+/* Logout denies local use immediately. Network failure leaves an unlink-only retry. */
+int ln_logout(ln_client *client);
+int ln_retry_pending_logouts(ln_client *client);
+int ln_logout_pending(ln_client *client);
 int ln_start_heartbeat(ln_client *client);
 void ln_stop_heartbeat(ln_client *client);
 void ln_destroy(ln_client *client);

data/vendor/curl/include/curl/curl.h

@@ -1135,7 +1135,7 @@ typedef CURLSTScode (*curl_hstswrite_callback)(CURL *easy,
 
 /* CURLOPT aliases that make no runtime difference */
 
-/* 'char *' argument to a string with a null-terminator */
+/* 'char *' argument to a string with a trailing zero */
 #define CURLOPTTYPE_STRINGPOINT CURLOPTTYPE_OBJECTPOINT
 
 /* 'struct curl_slist *' argument */
@@ -3042,9 +3042,8 @@ typedef enum {
 } curl_closepolicy;
 
 #define CURL_GLOBAL_SSL (1 << 0) /* no purpose since 7.57.0 */
-#define CURL_GLOBAL_WINSOCK (1 << 1)
-#define CURL_GLOBAL_WIN32 CURL_GLOBAL_WINSOCK /* for compatibility */
-#define CURL_GLOBAL_ALL (CURL_GLOBAL_SSL | CURL_GLOBAL_WINSOCK)
+#define CURL_GLOBAL_WIN32 (1 << 1)
+#define CURL_GLOBAL_ALL (CURL_GLOBAL_SSL | CURL_GLOBAL_WIN32)
 #define CURL_GLOBAL_NOTHING 0
 #define CURL_GLOBAL_DEFAULT CURL_GLOBAL_ALL
 #define CURL_GLOBAL_ACK_EINTR (1 << 2)

data/vendor/curl/include/curl/curlver.h

@@ -32,12 +32,12 @@
 
 /* This is the version number of the libcurl package from which this header
    file origins: */
-#define LIBCURL_VERSION "8.23.0"
+#define LIBCURL_VERSION "8.22.0"
 
 /* The numeric version number is also available "in parts" by using these
    defines: */
 #define LIBCURL_VERSION_MAJOR 8
-#define LIBCURL_VERSION_MINOR 23
+#define LIBCURL_VERSION_MINOR 22
 #define LIBCURL_VERSION_PATCH 0
 /* This is the numeric version of the libcurl version number, meant for easier
    parsing and comparisons by programs. The LIBCURL_VERSION_NUM define always
@@ -57,7 +57,7 @@
    Note: This define is the full hex number and _does not_ use the
    CURL_VERSION_BITS() macro since curl's own configure script greps for it
    and needs it to contain the full number. */
-#define LIBCURL_VERSION_NUM 0x081700
+#define LIBCURL_VERSION_NUM 0x081600
 
 /*
  * This is the date and time when the full source package was created. The
@@ -68,7 +68,7 @@
  *
  * "2007-11-23"
  */
-#define LIBCURL_TIMESTAMP "2026-10-14"
+#define LIBCURL_TIMESTAMP "2026-09-02"
 
 #define CURL_VERSION_BITS(x, y, z) ((x) << 16 | (y) << 8 | (z))
 #define CURL_AT_LEAST_VERSION(x, y, z) \

data/vendor/curl/include/curl/multi.h

@@ -538,7 +538,6 @@ CURL_EXTERN CURLMcode curl_multi_waitfds(CURLM *m,
  */
 #define CURLMNOTIFY_INFO_READ    0
 #define CURLMNOTIFY_EASY_DONE    1
-#define CURLMNOTIFY_LAST         2 /* last, not used */
 
 /*
  * Callback to install via CURLMOPT_NOTIFYFUNCTION.

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: licentivo-launch
 version: !ruby/object:Gem::Version
-  version: 0.1.2
+  version: 0.1.3
 platform: ruby
 authors:
 - Licentivo Launch contributors
@@ -46,6 +46,7 @@ files:
 - vendor/VERSION
 - vendor/c/app.c
 - vendor/c/demo.c
+- vendor/c/device_logout.h
 - vendor/c/feature_tasks.h
 - vendor/c/licentivo.c
 - vendor/c/licentivo.h