Plugin Catalog

This page lists every plugin in the repository on October 15, 2026. Use it to find a plugin close to your feature and copy its structure.

All plugins are inactive by default. Activation lives in plugins/statuses.json.

Summary

Reference plugins

example-hello-world

The smallest complete plugin. Use it as the starting point.

• src/HelloWorldPlugin.php registers a filter, a slot, and an admin menu entry.
• plugin.json shows the manifest shape.
• No database, no routes.

coupons

The best reference for a price filter with a ledger.

• checkout.price.calculate reads the posted coupon_code and returns a new float.
• checkout.coupon_field renders the input inside the order form.
• order.created records a pending redemption.
• order.paid confirms it.
• checkout.redeemed and checkout.paid cover instant quotes.
• subscription.purchase.initiated and subscription.activated cover plan coupons.
• Tables: coupons, coupon_redemptions.
• Permission: coupons-manage.
• Includes an operator CLI and a two-phase ledger.

Study the idempotency: a retried order.paid must not double-consume a coupon.

referrals

The best reference for attribution without schema changes.

• user.create_data stashes the raw ref value in the context.
• user.registered links the new user to the referrer.
• user.email_verified qualifies the signup.
• order.paid records the commission.
• dashboard.referral_panel renders the link and stats.
• Storage: pluggable store, SQLite by default.
• Tamper-evident codes via ReferralCodec.

nda

The best reference for plugin-owned MVC plus a contributed payment type.

• Slots: order.details_after, admin.order_details_after.
• Registries: dashboard.menu, admin.menu.
• Filter: payment.complete at priority 20. Non-matching types pass through.
• Tables: nda_agreements, nda_settings.
• Permission: nda-manage.
• Routes: nda/* and admin/nda/*.
• Fee funded by wallet (UnifiedWalletHistoryService::recordSpend) or a hosted gateway.
• Subscription gate read from user_subscriptions.

ai-toolkit

The best reference for deterministic-first AI with a fallback.

• Filters: ai.suggest.offer, ai.suggest.project, ai.suggest.profile.
• Search rerank on search.*.results.
• Slots: job.ai_assist, project.ai_assist, offer.ai_assist, profile.completion.
• Registry: auth.provider for LinkedIn mapping.
• Providers: OpenAI-compatible, DeepSeek, Ollama.
• Secrets are masked in the CLI and never logged.

Growth plugins

affiliate-marketing

• Action request reads ?aff= and stores a cookie or session key.
• user.registered and user.login create or update the affiliate record.
• order.paid records a conversion.
• dashboard.affiliate_panel renders stats.
• Tables: affiliates, affiliate_conversions.
• Permission: affiliate-manage.
• Supports first-touch and last-touch.

email-marketing

• Providers: Mailchimp, ActiveCampaign, ConvertKit, MailerLite, Brevo, GetResponse, Constant Contact, Klaviyo, Aweber, SendGrid.
• user.registered adds the contact.
• order.paid adds or tags the buyer.
• Config keys are prefixed email_marketing_.
• Permission: email-marketing-manage.
• No tables; state lives in provider lists.

subscription-offers

• Freelancer recurring offers with monthly or annual plans.
• order.paid activates a client subscription.
• cron.daily expires subscriptions.
• Tables: subscription_offers, subscription_offer_plans, client_subscriptions, subscription_invoices, subscription_deliverables.
• Permission: subscription-offers-manage.
• Default commission: 10%.

reports

• Overview, freelancers, clients, jobs, projects, orders, earnings, withdrawals, subscriptions.
• No hooks. Reads core models directly through a service layer.
• No tables.
• Permission: reports-view.
• Treat it as an operator tool, not a public API.

currency-switcher

• Admin CRUD for currencies and rates.
• Per-user switch route.
• Table: selected_currency_lists.
• Permission: currency-switcher-manage.
• Display conversion only; charging still uses the gateway currency.

Trust and safety

security-manage

• Filters: security.restricted_words, security.scan, security.violation_queue, security.user_frozen, security.login_blocked, security.email_allowed, security.access_blocked, security.rate_limit, security.content_fields.
• Actions: security.log_activity, security.violation_record, user.login_failed, user.login.
• Permissions: security-word-manage, security-log-manage, user-freeze-manage.
• Covers restricted words, contact detection, freezes, lockout, new-device alerts, disposable email blocking, IP and country access, rate limiting, alerts, and log pruning.

impersonate

• admin.user_details_after renders the button.
• body_end renders the impersonation banner.
• admin.assets loads the confirmation dialog.
• Permission: impersonate-users.
• No tables.

Content and SEO

seo-tools

• Filters: seo.page_title, seo.site_title, seo.meta_title, seo.meta_description, seo.meta_keywords, seo.og_title, seo.og_description, seo.og_url, seo.canonical_url, seo.extra_tags.
• Table: seo_tools_rules.
• Permission: seo-tools-manage.
• Rule match modes: exact, prefix, regex.
• Templates per page type.
• JSON-LD builder.
• head_end asset hook.

announcements

• announcement.popup slot rendered at body_end.
• Table: announcements_announcements.
• Permission: announcements-manage.
• Bar or popup, schedule window, audience, local storage dismissal.

AI plugins

aiengine

• search.talents.results, search.projects.results, search.jobs.results at priority 15.
• job.recommended_freelancers, client.recommended_freelancers, freelancer.recommended_jobs.
• project.related.results, job.related.results.
• CTA slots: projects.recommendation_cta, jobs.recommendation_cta, talents.recommendation_cta.
• Intent parser, scorer, ranker. Optional LLM; no API key required.

aipower

• Multi-provider text, image, translation, moderation, and semantic search.
• Filters: ai.suggest.*, search.*.results, security.scan.
• Slots: AI assist on create forms and admin assets.
• Tables: ai_prompts, ai_usages.
• Permission: aipower-manage.
• Usage and cost tracking.
• Strict frontend guardrails: rate limit, input cap, output cap, contact filtering.

Payments

pesapal-payment-gateway

• Registry gateway entry.
• payment.charge starts a hosted checkout.
• payment.complete settles through core.
• API v3; IPN and return verification.
• Merchant reference encodes type and record ID.
• Permission: pesapal-settings.
• No tables.

sepay-payment-gateway

• Registry gateway entry.
• payment.charge creates a VietQR payment.
• payment.complete settles through core.
• Webhook at /sepay/ipn.
• Payment code format: {PREFIX}{LETTER}{RECORD_ID}.
• Letters: WC, WF, O, S, P.
• Permission: sepay-settings.
• No tables.

coin-payment-gateway

• Registry gateway entry for CoinPayments.
• IPN verification and payment.complete.
• Ported module with legacyName: CoinPaymentGateway.

yoomoney-payment-gateway

• Registry gateway entry for YooMoney.
• IPN verification and payment.complete.
• Ported module with legacyName: YooMoneyPaymentGateway.

sms-gateway

• Not in the top-level plugin directory. Lives at core/plugins/sms-gateway.
• Service: SmsGateway\Services\OtpService.
• 23+ drivers across Global, India, Bangladesh, Middle East, Africa, Latin America, and WhatsApp.
• Used by phone verification and OTP login.
• Must be available before the framework boots.

Ported modules

cloud-storage

• Registry cloud_storage.driver with S3-compatible drivers.
• Registry cloud_storage.sync_source: core declares models, the plugin syncs.
• Action cloud_storage.sync_file; core dispatches SyncLocalFileWithCloud.
• Ported with legacyName: CloudStorage.

community

• Community feed, search, and details.
• Ported with legacyName: Community.

freelancer-level

• Filters: freelancer.level, freelancer.level2, freelancer.level.api, freelancer.level.data, freelancer.level.options, freelancer.level.rule.
• Benefit filters: commission.override, proposal.connect_cost, wallet.withdraw.holding_days, project.create.allowed, project.max_price, support.priority.
• Actions: order.completed, order.approved, order.rated, user.registered.
• Slots: support.ticket_list_badge, support.ticket_details_badge.
• Prize payout at 00:30 into freelancer_level_prizes.
• Ported with legacyName: FreelancerLevel.

hourly-job

• Hourly job posting and time tracking.
• Admin actions for hourly jobs.
• Ported with legacyName: HourlyJob.

promote-freelancer

• promotion.click, promotion.impression.
• Filters: promotion.revenue, promotion.transaction_fee, promotion.is_promoted, promotion.packages.
• payment.complete.promotion.
• Profile, project, and proposal promotion.
• Ported with legacyName: PromoteFreelancer.

Choosing a base

Anti-patterns seen in ports

Ported modules still do things new plugins should not:

• Import App\* or Modules\* internally.
• Read core models directly instead of using a seam.
• Keep legacy view namespaces forever.
• Mix admin and frontend controllers in one namespace.

When copying a ported module, keep its public behavior but rewrite the internals against PluginsFramework\* and the seams in Hooks, Slots & Registry.

---

Last updated: October 21, 2026