Packages from sugarcommerce · Transparency log
-
PHP
sugarcommerce/cloudflare
Cloudflare for SaaS custom hostnames: add a customer's domain, ask how it is going, remove it, with Cloudflare's two separate verifications read as one status a shop can act on.
-
PHP
sugarcommerce/countries
ISO 3166-1 country data: codes, names, emoji flags, EU membership, sanctioned and elevated-risk territories. Zero dependencies.
-
PHP
sugarcommerce/currency
Money formatting and parsing for integer minor units. 136 currencies with correct decimal exponents — including the twenty where dividing by 100 is wrong. Zero dependencies.
-
PHP
sugarcommerce/data-subject
The small, easily-botched pieces of answering a GDPR access or erasure request: the export without the columns a person must not be handed, finding an address in stored payloads however JSON escaped it, an audit trail that does not undo the erasure it records, and plain summaries of what was done. Z
-
PHP
sugarcommerce/dates
UTC-first date handling: freezable clock, safe timestamp parsing, relative times, and reporting ranges with exclusive ends. Zero dependencies.
-
PHP
sugarcommerce/dev-tools
Development checks for the SugarCommerce family and the apps built on it: a docblock coverage report that can gate a build, and a headless-Chrome smoke test that loads every page and fails on any console error. Zero dependencies.
-
PHP
sugarcommerce/discord
The Discord calls for giving a role on purchase: a bot invite link, user sign-in with PKCE, adding a member with a role, and taking the role back, with the DiscordBot User-Agent the API requires.
-
PHP
sugarcommerce/email-templates
Declarative transactional email rendering: layouts, operator-editable bodies, and typed components. Tags are escaped for the context they land in, and an unresolved tag never reaches a customer. Zero dependencies.
-
PHP
sugarcommerce/embeds
Turn a URL somebody pasted into an embed you can safely put in an iframe. A closed list of platforms, exact host matching, and a src rebuilt from validated parts rather than the string that arrived. Zero dependencies.
-
PHP
sugarcommerce/env
Environment configuration for plain PHP: .env parsing that handles quotes and multi-line values, typed accessors that fail loudly on a missing requirement, and no global mutation. Zero dependencies.
-
PHP
sugarcommerce/file-inspect
Look at the bytes a file actually contains: executable signatures refused whatever the name, contents that disagree with the extension, archives carrying what you would not accept directly, and double extensions that hide the real one. Pure functions, no I/O, zero dependencies.
-
PHP
sugarcommerce/format-utils
Display formatting: byte sizes, durations, compact numbers, word-safe truncation, deterministic initials avatars, file-type labels and content types, and forgiving search. Parses back what it formats. Zero dependencies.
-
PHP
sugarcommerce/generate
Identifier generation: UUID v4 and v7, human-readable licence and discount codes, transliterating slugs, and CSPRNG-backed API keys. Zero dependencies.
-
PHP
sugarcommerce/github
The GitHub calls for selling access to private repositories: a GitHub App's RS256 JWT and installation tokens, user sign-in with PKCE that handles GitHub's 200-with-an-error answer, and collaborator invitations kept by numeric id rather than by a login that can be renamed.
-
PHP
sugarcommerce/health
The mechanism of a doctor script: collect ok/warn/fail checks, print an aligned report, exit non-zero on failure so a deploy can be gated on it, and post the failures to a chat webhook. The checks themselves stay in your application.
-
PHP
sugarcommerce/http
A request, a response, a router and a template renderer for plain PHP. Small enough to read in one sitting, complete enough that an application never touches a superglobal.
-
PHP
sugarcommerce/http-client
Outbound HTTP client with SSRF protection on by default. Validates and pins the target address, re-validates every redirect hop, and caps response size. Zero dependencies.
-
PHP
sugarcommerce/i18n
Translation for plain PHP: English source strings as keys, CLDR plural categories, named placeholders, and Accept-Language negotiation. Catalogues are PHP arrays, so they are opcached and need no parser. Zero dependencies.
-
PHP
sugarcommerce/image-variants
Resized image variants for responsive delivery. Returns bytes rather than writing files, corrects EXIF orientation, strips metadata, never upscales, and refuses decompression bombs. Zero dependencies.
-
PHP
sugarcommerce/licensing
Licence-key seats for software sellers: validate a key (and one installation of it) with a reason a client can show, claim a seat atomically so parallel activations cannot overrun the limit, and release it by an instance id the server issued. Storage is yours, behind one interface. Zero dependencies
-
PHP
sugarcommerce/mailer
Transactional email for self-hosted PHP. One Message, many transports: Postmark, Resend, Amazon SES, Cloudflare Email, SMTP, plus log and in-memory for development. Full MIME serialisation with inline images, attachments and RFC 2047 headers. Header-injection safe. Zero dependencies.
-
PHP
sugarcommerce/mcp-server
A Model Context Protocol server for plain PHP. Implements the 2026-07-28 revision, and serves 2025-11-25 and 2025-06-18 clients: stateless per-request negotiation, JSON-RPC 2.0 over Streamable HTTP, typed tools with JSON Schema validation, and scope-based authorization. Zero dependencies.
-
PHP
sugarcommerce/network
Request-level network utilities: spoof-resistant client IP behind proxies and CDNs, CIDR matching, GDPR anonymisation, user-agent and bot detection, referrer and campaign attribution. Zero dependencies.
-
PHP
sugarcommerce/notice-and-action
The structure a hosting service's notice-and-action process needs: the elements a report or a copyright notice must have before it can be acted on (EU Digital Services Act Article 16, US DMCA section 512(c)(3)), the statement of reasons a restriction must come with (DSA Article 17), and public refer
-
PHP
sugarcommerce/oauth
The two halves of an OAuth 2.0 authorization-code round trip that providers leave to you: a PKCE pair (RFC 7636, S256) and a signed state bound to a cookie in the browser that started the trip, so a callback is only honoured where it began.
-
PHP
sugarcommerce/oauth-server
The authorization-server half of OAuth 2.1 for a remote MCP server: protected resource and authorization server metadata, Client ID Metadata Documents and dynamic registration, authorization code with S256 PKCE, resource-bound opaque tokens, rotating refresh tokens with reuse detection, and revocati
-
PHP
sugarcommerce/object-storage
A small client for one S3-compatible bucket — R2, S3, B2, MinIO: multipart uploads the browser does directly, ranged reads, the real stored size, presigned downloads and the bucket's CORS policy. Built on sugarcommerce/s3-signer and sugarcommerce/http-client.
-
PHP
sugarcommerce/outbox
A durable send queue on SQLite: rows claimed atomically under a lease so overlapping workers never send twice, a crashed worker's rows come back on their own, and retries follow a status-aware backoff policy. An inbox that handles each incoming event once. Plus the pieces that bound a cron run: a lo
-
PHP
sugarcommerce/paginate
Paging, sorting and search for list screens, with the column names allow-listed because they cannot be bound as parameters. Returns a page object that knows how to render its own controls.
-
PHP
sugarcommerce/rate-limit
Sliding-window rate limiting with atomic counters. APCu, SQLite, file and in-memory stores, standard rate-limit headers, and an API that makes forgetting the identity key impossible. Zero dependencies.
-
PHP
sugarcommerce/s3-signer
AWS Signature Version 4 signing for S3-compatible object storage. Presigned URLs and signed request headers, no HTTP client, no SDK. Verified against Cloudflare R2, AWS S3, Backblaze B2 and DigitalOcean Spaces.
-
PHP
sugarcommerce/sanitize
Untrusted strings in, something safe to store out. Control characters and display-spoofing Unicode stripped, addresses and URLs validated, integers clamped, allow-lists for the values that reach SQL as identifiers. Zero dependencies.
-
PHP
sugarcommerce/signed-tokens
HMAC-signed, expiring, namespaced tokens for URLs. Magic sign-in links, password resets, download URLs and unsubscribe links with no database row. Zero dependencies, supports secret rotation.
-
PHP
sugarcommerce/sqlite
SQLite for web applications: correct pragmas, type-aware binding, immediate write transactions with retry, schema introspection and idempotent migrations. Zero dependencies.
-
PHP
sugarcommerce/stripe
A small Stripe client for Connect platforms: pinned API version, Stripe-Account per request, a fetch that throws instead of answering null, signed event parsing with payload redaction, and readers for the fields Stripe moves between API versions.
-
PHP
sugarcommerce/templates
A small Blade-like template engine for plain PHP: auto-escaping by default, layouts and sections, includes, and compiled output cached to disk. Zero dependencies.
-
PHP
sugarcommerce/text-pdf
PDF generation with no dependencies. Invoices, statements and receipts with tables, vector SVG logos, multi-page flow, EU VAT treatments including reverse charge, and 11 languages. Injection-safe.
-
PHP
sugarcommerce/totp
TOTP (RFC 6238) and HOTP (RFC 4226) two-factor authentication codes. Zero dependencies, verified against the official RFC test vectors. Works with Google Authenticator, 1Password, Bitwarden and Authy.
-
PHP
sugarcommerce/turnstile
Server-side verification of Cloudflare Turnstile tokens that fails closed: no secret, no answer, a slow answer or an unreadable one is a refusal, and a token minted for another site, another form or too long ago is refused too.
-
PHP
sugarcommerce/virus-scan
Malware scanning for stored uploads: ClamAV over clamd's INSTREAM, a VirusTotal lookup by digest, and a panel that combines them without mistaking an outage for a clean bill of health. Files are read a range at a time, so a two-gigabyte upload never sits in memory.
-
PHP
sugarcommerce/web-security
Signed-cookie sessions for a single shared password, CSRF tokens with nothing to store, and keyed hashing for the values an application must compare but never read back.
-
PHP
sugarcommerce/webhooks
Webhook signing, verification and retry scheduling. Stripe-style t=,v1= signatures with replay protection, constant-time comparison, and a retry policy that distinguishes the receiver's problems from your own. Zero dependencies.
-
PHP
sugarcommerce/zip-stream
Write a ZIP straight to the client without building it first. Members are streamed through, so a 40 GB archive costs a buffer rather than disk, and ZIP64 turns on by itself when the numbers need it.