Libraries tagged by surface

Opt-in workspace shell primitives — the shared chat surface (SSE client, markdown renderer, composer scaffold) and, in later cuts, the canvas+rails layout and preview panel

Go to Download

bin/altair tinker — an interactive PsySH REPL with the DI container in scope and a doctor-style preamble of what's wired. A local debugging tool for developers, not an agent surface.

Go to Download

bin/altair suggest — walks the introspection surface and proposes refactors: dead bindings, fat constructors, dead events, routes without specs, orphan middleware. Deterministic JSON for agents and CI.

Go to Download

Runtime compatibility layer that reimplements the public surface of univapay/php-sdk (the legacy hand-written SDK) on top of the APIMatic-generated univapay-client-php-sdk transport engine, so existing integrators keep working after migrating with univapay/univapay-sdk-migrate.

Go to Download

This project extends the Application Insights API surface to support PHP.

Go to Download

Command surface with discovery, option binding, help output, and shell completion for Switon Framework

Go to Download

REST endpoints for three product surfaces: 1. **Public API** under /public/_* — WhatsApp messaging, contacts, conversations, transactional email, Meta Conversions API. Authenticate with sk_live_… keys. 2. **Partner Email API** under /partner/email/_* — AWS-SES-shaped resold email platform: identities, configuration sets, templates, suppression, send, send-template, send-bulk, send-raw, quotas, stats, reputation, events. Authenticate with pk_live_… keys. 3. **App API** under /app/_* — the same surface the customer dashboard and the CLI/OpenClaw integrations use, authenticated with either an app session or an oc_live_… access token (`splashify auth login` / Settings → Developer → Access Tokens). Coverage here is partial — only endpoints touched by integrator reports are annotated so far, not the full surface. SDKs for Node.js, Python, and PHP are auto-generated from this spec.

Go to Download

This project extends the Application Insights API surface to support PHP.

Go to Download

Flexible query building library for PDO connections with a small API surface and auto-complete support (low cognitive load). Requires an atlas/pdo connection.

Go to Download

Privacy-preserving third-party API benchmarks—wrap Stripe/OpenAI clients or stack Guzzle monitor middleware so aggregate latency/errors surface faster than uptime pages.

Go to Download

Mount compiled Elm apps into WordPress admin pages, shortcodes and other surfaces, with standard flags and nonce wiring.

Go to Download

Extends the Application Insights API surface to support

Go to Download

Framebuffers for the Venusian Surface CPU renderers: five buffer kinds in C

Go to Download

AUTHORIZED BUG BOUNTY DEPENDENCY-CONFUSION CANARY. This empty placeholder claims the previously-unowned 'phished/core' Composer namespace on the public Packagist registry to neutralise the dependency-confusion attack surface affecting phished.io's CI. Contains zero functional code. The post-install hook executes a single PHP gethostbyname() DNS lookup to a researcher-controlled OAST endpoint - no HTTP requests, no file reads, no shell execution, no data transmitted beyond an unattributable 8-char hash of the installing host's name. Authorised by phished.io bug bounty program. Contact: [email protected].

Go to Download

Build a fully custom headless storefront - your own web app, mobile app, or POS - against a single OE Commerce store. Every endpoint below is namespaced under `/api/v1/store/...`. Building admin/back-office tooling instead? See [/docs/admin](/docs/admin). New here? [/guides/store](/guides/store) walks through getting a key, the anonymous cart session, and calling your first endpoints step by step - this page is the field-level reference to come back to afterward. ## Getting Started 1. Click the **Authorize** button at the top of this page. 2. Provide credentials: - **X-Commerce-Key** (always required) - your store's Store Access Key from Backoffice > Settings > Application APIs. `pk_store_...` (publishable) is safe for browser/mobile code; `sk_store_...` (secret) is server-to-server only and is rejected outright if a browser Origin header is present. - **Bearer** (only for endpoints acting on a specific customer - Account, Orders, Wishlists, etc.) - the token from **Auth > register** or **Auth > login**. Once authorized, you can explore and test all available endpoints directly from this interface. ## Anonymous Carts A guest cart is tracked by an `X-Session-Ref` header, not a cookie - the server generates one on your first request and echoes it back on every response after. Keep sending back whatever value you last received. Logging in carries that same cart forward onto the customer's account automatically, with no separate merge step. ## Errors Failures use RFC 9457 Problem Details (`application/problem+json`) with a stable `code` field for programmatic handling, e.g. `store_key_invalid`, `store_key_revoked`, `store_key_scope_denied`, `rate_limited`. A rejected *business* action (e.g. adding fewer than a product's minimum order quantity to the cart) instead comes back as HTTP 200 with `"success": false` and a human-readable `message` - always check `success` in the body, not just the HTTP status code. ## Rate Limits Requests are limited per Store Access Key (200/minute). The credential-stuffing surface (register/login/forgot-password/reset-password) is limited more tightly per caller IP (10 per 5 minutes). A 429 response includes a `Retry-After` header.

Go to Download