PHPackages capell-app/marketplace - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. capell-app/marketplace ActiveLibrary capell-app/marketplace ====================== Extension marketplace browsing and acquisition for Capell CMS. v1.0.35(2w ago)0371MITPHPPHP ^8.4 Since Jul 11Pushed 2d agoCompare [ Source](https://github.com/capell-app/marketplace)[ Packagist](https://packagist.org/packages/capell-app/marketplace)[ Docs](https://github.com/capell-app/marketplace)[ RSS](/packages/capell-app-marketplace/feed)WikiDiscussions main Synced 1w ago READMEChangelog (10)Dependencies (20)Versions (35)Used By (1) Capell Marketplace ================== [](#capell-marketplace) [![Capell Marketplace catalogue discovery, extension evaluation, and operation state](docs/assets/readme/hero.jpg)](docs/assets/readme/hero.jpg) [![Latest Release](https://camo.githubusercontent.com/a73ee4a82a67819af2fcb4205ee4dcd1652bd6e58e2f0ce64cc350697b7726c8/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f762f72656c656173652f636170656c6c2d6170702f6d61726b6574706c6163653f7374796c653d666c61742d737175617265266c6162656c3d72656c65617365)](https://github.com/capell-app/marketplace/releases/latest)[![Latest Version on Packagist](https://camo.githubusercontent.com/f8db32d10eb78ba8270c7c5b8a7f41d4076fe959adacb17db1418dab7ca53f28/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f762f636170656c6c2d6170702f6d61726b6574706c6163652e7376673f7374796c653d666c61742d737175617265)](https://packagist.org/packages/capell-app/marketplace)[![Tests](https://github.com/capell-app/capell/actions/workflows/test-full.yml/badge.svg?branch=main)](https://github.com/capell-app/capell/actions/workflows/test-full.yml)[![PHP Quality](https://github.com/capell-app/capell/actions/workflows/code-quality-and-styling.yml/badge.svg?branch=main)](https://github.com/capell-app/capell/actions/workflows/code-quality-and-styling.yml)[![PHP](https://camo.githubusercontent.com/d072d1f17b6a8dc799e782e39d676d25cab3e73854efe49206d6ffcb6473abd4/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f5048502d382e342d3737374242343f7374796c653d666c61742d737175617265266c6f676f3d706870266c6f676f436f6c6f723d7768697465)](#requirements-and-support-policy)[![Laravel Compatibility](https://camo.githubusercontent.com/dc20b793bdd9104858de241da34bef8045bfaa2d3a89b9aec1555f3cd6f755cb/68747470733a2f2f62616467652e6c61726176656c2e636c6f75642f62616467652f636170656c6c2d6170702f6d61726b6574706c6163653f7374796c653d666c6174)](https://packagist.org/packages/capell-app/marketplace)[![Documentation](https://camo.githubusercontent.com/74103e2593167ea862d42050aa01301e640df4e220bea126345e2310db5fe14e/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f646f63732d646f63732e636170656c6c2e6170702d626c75653f7374796c653d666c61742d737175617265)](https://docs.capell.app) `capell-app/marketplace` connects a Capell installation to the Capell extension marketplace. It owns catalogue browsing, Capell account linking, heartbeat/update advisory state, account-based Marketplace install eligibility decisions, queued local Composer install operations, free-install telemetry, and signed install/upgrade authorization records for protected extensions. Use this package when an admin needs to discover, authorize, or maintain extensions from the Capell marketplace. Local enable, disable, uninstall, and bulk extension management remain part of the installed Extensions surface. Package Boundary ---------------- [](#package-boundary) Marketplace owns: - the Extensions-page Marketplace action, extension browser, extension detail flow, account connection action, heartbeat action, and install attempt ledger - signed Marketplace client requests, account connection callbacks, catalogue caching, heartbeat snapshots, update notices, advisory dismissals, registration sessions, install attempts, queued local Composer operations, and queued free-install telemetry - Marketplace permissions for viewing extension and Marketplace surfaces Marketplace does not own: - Core package registry internals or generic package cache behavior - Admin's installed Extensions table and local extension management actions - production deployment completion after a Composer change has been published by Deployments - public frontend rendering or theme output Install ------- [](#install) ``` composer require capell-app/marketplace ``` The package is enabled by default. Main config values: Env varPurpose`CAPELL_MARKETPLACE_ENABLED`Enable Marketplace integration.`CAPELL_INSTANCE_ID`Existing Marketplace instance ID fallback.`CAPELL_MARKETPLACE_URL`Marketplace API base URL. Defaults to `https://capell.app/api/v1`.`CAPELL_MARKETPLACE_WEB_URL`Public web URL for purchase and account flows.`CAPELL_MARKETPLACE_CATALOGUE_PAGE_LIMIT`Maximum catalogue pages fetched for the browser listing.`CAPELL_MARKETPLACE_WEBHOOK_URL`Public callback URL used by Capell App when `APP_URL` is not enough.`CAPELL_MARKETPLACE_WEBHOOK_SECRET`Fallback signing secret for configured instances.`CAPELL_MARKETPLACE_TROUBLESHOOTING_URL`Help URL shown from Marketplace heartbeat failures.Only override `CAPELL_MARKETPLACE_URL` for staging or self-hosted Marketplace APIs. The active public API path is versioned with `/api/v1`. Runtime Surfaces ---------------- [](#runtime-surfaces) - Provider: `Capell\Marketplace\Providers\MarketplaceServiceProvider` - Config: `config/capell-marketplace.php` - Routes: `routes/marketplace.php` - Marketplace client: `Capell\Marketplace\Services\MarketplaceClient` - Main Filament surfaces: `MarketplaceExtensionDetailPage`, `MarketplacePackageOperationsPage`, `MarketplaceExtensionsBrowser`, marketplace actions on the installed Extensions page, connection status actions, and the extension health widget - Admin extenders: `MarketplaceExtensionsPageExtender` tagged as `ExtensionsPageExtender::TAG`; `ThemeMarketplaceHeaderActionExtender` tagged as `ResourceHeaderActionExtender::TAG` - Header action registry keys: `capell-marketplace.open-marketplace`, `capell-marketplace.connect-account` - Livewire aliases: `capell-marketplace.marketplace-extensions-browser` and `capell-marketplace::marketplace-extensions-browser` - Activation binding: `capell.marketplace.activation-verifier` - Main actions/jobs: `StartMarketplaceAccountConnectionAction`, `CompleteMarketplaceAccountConnectionAction`, `PhoneHomeAction`, `CheckForUpdatesAction`, `InstallMarketplaceExtensionAction`, `CreateExtensionAcquisitionAction`, `CreateMarketplaceInstallAttemptAction`, `TransitionMarketplaceInstallAttemptAction`, `QueueMarketplaceInstallAttemptAction`, `RunMarketplaceInstallAttemptJob`, `CancelMarketplaceInstallAttemptAction`, `RecordThemeInstallIntentAction`, `ResolvePendingThemeInstallsAction`, `VerifyMarketplaceSignedActivationAction`. `RecordMarketplaceInstallAttemptAction` remains a deprecated 1.x compatibility adapter. The account connection callback is authenticated under the configured admin path. How The Main Flows Work ----------------------- [](#how-the-main-flows-work) FlowClassesNotesAccount connection`StartMarketplaceAccountConnectionAction`, `CompleteMarketplaceAccountConnectionAction`, `MarketplaceAccountConnectionCallbackController`Creates a short-lived account connection session, redirects the admin to Capell App, validates the returned state/code, requires a verified account email, stores account identity in `marketplace_instances`, returns to Extensions, and opens the Marketplace setup cockpit.Catalogue browsing`MarketplaceClient`, `MarketplaceExtensionsBrowser`, `MarketplaceCatalogueTable`, `BuildMarketplaceSelectionReviewAction`Fetches JSON catalogue pages from `/extensions`, scopes cache keys by query and connection context, hides already installed extensions by default with a ternary installed-status filter, serves stale cache only when the browser explicitly allows it, and builds dependency-aware multi-extension review through typed selection policy data.Install authorization`InstallMarketplaceExtensionAction`, `MarketplaceInstallEligibilityData`, `CreateExtensionAcquisitionAction`, `MarketplaceInstallActionPresenter`Orchestrates install lookup, selected options, eligibility, purchase/blocked handling, attempt recording, theme intent recording, free telemetry, local Composer queueing, notification handoff, and Deployments handoff status.Package operations`CreateMarketplaceInstallAttemptAction`, `TransitionMarketplaceInstallAttemptAction`, `ClaimMarketplaceInstallDeploymentPublicationAction`, `RecordMarketplaceInstallDeploymentAction`, `DispatchMarketplaceInstallAttemptAction`, `FinalizeMarketplaceInstallAttemptAction`, `QueueMarketplaceInstallAttemptAction`, `RunMarketplaceInstallAttemptJob`, `CancelMarketplaceInstallAttemptAction`, `RetryMarketplaceInstallAttemptAction`Creates attempts through typed Data, enforces row-locked lifecycle transitions and finalization, claims deployment publication before remote work, records deployment evidence/classification/timeline state atomically, orders cancellation against job dispatch under the row lock, runs one local Composer operation at a time, exposes the dedicated Package Operations page, and emails Package Operations subscribers when manual attention is needed.Theme install resolution`RecordThemeInstallIntentAction`, `ResolvePendingThemeInstallsAction`Records pending theme install choices and resolves them when the Composer package is present.Heartbeat/update checks`PhoneHomeAction`, `CheckForUpdatesAction`, `RecordUpdateAdvisorySnapshotAction`Sends installed package snapshots and stores update/advisory results locally.Extension detail pages include a collapsed manual install option for hosts where queued Composer is not appropriate. Revealing it shows the package-specific `composer require` command followed by `php artisan capell:extension-install `. Account Trust Flow ------------------ [](#account-trust-flow) Account linking is the trust path for protected extensions. An admin connects a Capell account, approves the connection in Capell App, returns to `/admin/extensions`, and the Extensions page opens the Marketplace setup cockpit for install readiness. Free extensions do not require a connected account. Data And Security ----------------- [](#data-and-security) Marketplace is schema-owning. Its current tables are `marketplace_instances`, `marketplace_update_advisory_snapshots`, `marketplace_update_notice_dismissals`, `marketplace_account_connection_sessions`, `marketplace_install_flow_sessions`, `marketplace_install_attempts`, the append-only `marketplace_install_attempt_events` timeline, and legacy `marketplace_install_intents`. Older installations may retain legacy domain tables, but this package no longer reads them for install access. The package stores Marketplace instance IDs and encrypted signing secrets. Authorization requests are signed before they are sent to Capell App. Do not expose instance credentials, signing secrets, or licence keys in public output or unauthenticated admin copy. Signed authorization proves Marketplace entitlement and request integrity. It does not make a package's runtime code, screenshots, docs, or public/admin output inherently safe. Treat marketplace metadata as remote product data and treat installed extension code as normal executable application code. Catalogue responses are cached for a short period. The cache is scoped by query and Marketplace account context so connected-account state can affect visible actions without leaking one installation's state to another. The browser also checks local active install attempts so duplicate install actions for the same Composer package are blocked while an operation is queued, running, or cancellation is pending. Grouped selection policy lives in `BuildMarketplaceSelectionReviewAction`, not the Livewire browser. It preserves explicit selection order, expands transitive dependencies once even when dependency graphs cycle, and returns stable failure reason codes through typed selection Data. Livewire remains responsible for authorization, translating those codes, notifications, redirects, and rendering. Marketplace install operations are tracked in `marketplace_install_attempts`, with detailed timeline rows in `marketplace_install_attempt_events`. New attempts are created from `MarketplaceInstallAttemptData`. Lifecycle changes use `MarketplaceInstallAttemptTransitionData` and a transaction with a row lock. The allowed graph is queued to running, failed, or cancelled; running to succeeded, failed, timed out, or cancellation requested; and cancellation requested to cancelled or failed. Terminal lifecycle state is immutable and retries create one serialized queued row. Starting an install runs preflight checks, queues `composer require --no-interaction --prefer-dist --with-all-dependencies` only when preflight passes, claims the deployment-publication phase before invoking a configured publisher, and records safe output/error excerpts. Cancellation that commits before the claim prevents remote publication. Deployment results, classification, and timeline evidence commit together; a cancellation that wins after publication is claimed still retains the returned remote reference without dispatching local install work. Failed preflight checks retain supplied audit metadata and are stored as failed attempts so admins can inspect them. Active and attention-needed operations are opened from the Extensions page header action, which deep-links to the dedicated Package Operations page and shows a badge while operations exist. Free/local Marketplace installs also redirect there immediately after queueing, with the queued operation selected so the admin can watch progress instead of staying in the Marketplace browser. The dashboard alert stays a compact summary. The Package Operations page owns filtering, operation details, timeline review, retry, cancel, mark resolved, and redacted diagnostic export. Cancelling a queued operation prevents Composer from running; cancelling a running operation normally lets Composer finish and then skips lifecycle work. If cancellation arrives after lifecycle work has already completed, finalization records non-retryable manual-attention evidence instead of reporting success or automatically reinstalling the package. Retry creates a new attempt linked to the failed source row, preserving the ledger. Package Operations notifications default to super admins and can be managed through notification preferences. Verification ------------ [](#verification) From the split repository root, with development dependencies installed, run Marketplace package tests after changing account connection, catalogue, heartbeat, permission, telemetry, or install authorization behavior: ``` vendor/bin/pest tests ``` Run focused action or HTTP tests first when changing a specific flow, for example: ``` vendor/bin/pest tests/Feature/Actions/MarketplaceAccountConnectionActionTest.php --configuration=phpunit.xml vendor/bin/pest tests/Feature/Http/MarketplaceAccountConnectionCallbackControllerTest.php --configuration=phpunit.xml ``` Requirements And Support Policy ------------------------------- [](#requirements-and-support-policy) SurfaceSupported versionsPHP`^8.4`Laravel`^13.0`CoreThe same release as this packageAdminThe same release as this packageEach Capell 1.x minor receives security fixes for 24 months from its release date, and the latest 1.x minor is always supported. Upgrade all installed Capell foundation packages together to the same supported release before requesting a fix. See the [Capell security policy](https://github.com/capell-app/capell/security/policy) for vulnerability reporting. Support covers the dependency ranges above. When an upstream release reaches its own end of life earlier, upgrading that dependency may be required to receive a safe fix. Troubleshooting --------------- [](#troubleshooting) SymptomCheckFixMarketplace API route errors`php artisan config:show capell-marketplace.marketplace.base_url`Use `https://capell.app/api/v1` and run `php artisan config:clear`.Connect account fails immediately`php artisan config:show app.url` and the latest `marketplace_account_connection_sessions.last_error`Set `APP_URL` to a URL with a host, clear config cache, and retry before the 10-minute session expires.Account callback says the session or state is invalidLatest row in `marketplace_account_connection_sessions`Retry from the same browser tab. Do not reuse old approval URLs after starting a newer connection.Catalogue loads but install is blockedMarketplace detail response `install_eligibility`, authorization response, and connected account stateResolve the Marketplace-provided account, email verification, entitlement, purchase, activation, or compatibility requirement, then request authorization again.Install is queued or running for the same packagePackage Operations page or `marketplace_install_attempts.status`Wait for completion or cancel from Package Operations.Preflight fails before Composer startsPackage Operations timeline and `failure_stage = preflight`Fix the reported PHP, Composer, writeability, duplicate install, or queue readiness issue, then retry from Package Operations.Local Composer install fails or times outPackage Operations notification, `failure_type`, timeline, `failure_reason`, `output_excerpt`, and `error_excerpt`Fix the Composer/runtime issue, confirm whether files were partially installed, then retry from Package Operations. If web-triggered Composer is unavailable on the host, run the recorded command in deployment, then run `php artisan package:discover`, `php artisan capell:extension-install `, and `php artisan optimize:clear`.Deployments publishing failsAttempt `deployment.status` and Package Operations notificationFix Deployments configuration or publish the Composer change manually; the local Composer install still runs unless the operation is cancelled.Deployments is not connectedAttempt `deployment.status`No manual action is shown by default; connect Deployments if this installation should publish Composer changes to a deployment source.Heartbeat/update check failsThe `RunMarketplaceHeartbeatAction::run()` failure message or admin notification copySet `APP_URL` or `CAPELL_MARKETPLACE_WEBHOOK_URL`, confirm an instance exists, and check network access to the API URL.Catalogue looks staleCache keys beginning `capell-marketplace.marketplace.*`Run `php artisan cache:clear` locally, or use the browser refresh action when available.Marketplace surfaces disappear`CAPELL_MARKETPLACE_ENABLED` and `php artisan optimize:clear`Re-enable the package config and clear cached config/routes.Development ----------- [](#development) Package development and coordinated verification happen in the [capell-app/capell monorepo](https://github.com/capell-app/capell). Split package repositories are release mirrors; use [docs.capell.app](https://docs.capell.app) for cross-package guidance. See the [contribution guide](https://github.com/capell-app/capell/blob/main/CONTRIBUTING.md), [security policy](https://github.com/capell-app/capell/security/policy), and [licence](https://github.com/capell-app/capell/blob/main/LICENSE.md). Further Reading --------------- [](#further-reading) PageCovers[Marketplace overview](docs/overview.md)Marketplace responsibilities, admin flow, account linking, and install access.The complete Marketplace operations and package-authoring guides are published at [docs.capell.app](https://docs.capell.app). ### Health Score 48 — FairBetter than 94% of packages Maintenance98 Actively maintained with recent releases Popularity10 Limited adoption so far Community13 Small or concentrated contributor base Maturity63 Established project with proven stability Bus Factor1 Top contributor holds 62.5% of commits — single point of failure How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window. **Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores. **Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement. **Maturity (30%)** — Project age, version count, PHP version support, and release stability. ### Release Activity Cadence Every ~1 days Total 32 Last Release 16d ago ### Community Maintainers ![](https://www.gravatar.com/avatar/85b211531c530cd60c8e1b7b2c125c7e42192c820cde99fb6b201b1dde7a9d96?d=identicon)[capell-app](/maintainers/capell-app) --- Top Contributors [![howdu](https://avatars.githubusercontent.com/u/533658?v=4)](https://github.com/howdu "howdu (30 commits)")[![capell-app-user](https://avatars.githubusercontent.com/u/213955377?v=4)](https://github.com/capell-app-user "capell-app-user (14 commits)")[![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?v=4)](https://github.com/github-actions[bot] "github-actions[bot] (3 commits)")[![web2w](https://avatars.githubusercontent.com/u/23355558?v=4)](https://github.com/web2w "web2w (1 commits)") --- Tags capellcapell-cmsecommerceextensionsfilamentlaravellaravel-packagemarketplacepackage-managementphplaravelcmsmarketplacecapell ### Code Quality TestsPest ### Embed Badge ![Health badge](/badges/capell-app-marketplace/health.svg) ``` [![Health](https://phpackages.com/badges/capell-app-marketplace/health.svg)](https://phpackages.com/packages/capell-app-marketplace) ``` ### Alternatives [binaryk/laravel-restify Laravel REST API helpers 683461.9k](/packages/binaryk-laravel-restify)[relaticle/custom-fields User Defined Custom Fields for Laravel Filament 16472.9k](/packages/relaticle-custom-fields)[danestves/laravel-polar A package to easily integrate your Laravel application with Polar.sh 8327.5k](/packages/danestves-laravel-polar)[slimani/filament-media-manager A media manager plugin for Filament. 1714.7k2](/packages/slimani-filament-media-manager)[tarfin-labs/event-machine Event-driven state machines for Laravel with event sourcing, type-safe context, and full audit trail. 219.6k](/packages/tarfin-labs-event-machine) PHPackages © 2026 [Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)