Open source # Open source at Byte Minus We release the platforms we build so that the schools, merchants and developers who rely on them can read the code, run it themselves and make it better. Permissive licenses, decisions written down, tests in CI. [Follow us on GitHub](https://github.com/byteminus) [How to contribute](https://byteminus.com/open-source/#contributing) ## Projects - MIT license - Released - Payments · Laravel · Node.js ## BDPayGate Every Bangladeshi payment gateway behind one API, for Laravel and for Node.js. bKash, Nagad, SSLCommerz, Upay, ShurjoPay, aamarPay, PortPos, PayStation, UddoktaPay, Moneybag, EPS and DGePay all use the same `charge`, callback, `sync` and `refund` — and nothing the browser sends can mark an order paid. - **No callback is trusted.** Redirects, IPNs and webhooks only say which payment to check. The package asks the gateway’s own API and matches the amount and currency before anything changes. - **Paid exactly once.** Status changes are atomic, so when the IPN and the customer’s redirect arrive together, `PaymentCompleted` still fires once. - **A timeout is not a failure.** If the gateway doesn’t answer, the payment stays pending and `bdpaygate:sync` settles it later. - **Retries can’t double charge.** Each retry is its own attempt; a customer who pays two gets you a `PaymentDuplicated` event to refund, not a second order. - **Customers stay signed in.** Callback routes run without sessions, so the gateway’s cross-site POST back doesn’t log anyone out at checkout. - **Refunds and tests built in.** Full and partial refunds where the gateway has an API, and `BdPayGate::fake()` for tests with no network or credentials. - **Now for Node.js too.** `npm install bdpaygate`: the same gateways and the same rules in strict TypeScript, with zero runtime dependencies, on Node.js 20.19+, Bun, Deno and Cloudflare Workers. Express, Next.js, NestJS, Fastify, Hono and more — and it shares the Laravel package’s payments table, so a PHP and a Node app can run side by side. [Read the docs](https://bdpaygate.github.io/) [GitHub](https://github.com/byteminus/laravel-bdpaygate) [Packagist](https://packagist.org/packages/byteminus/laravel-bdpaygate) [npm](https://www.npmjs.com/package/bdpaygate) [Launch post](https://byteminus.com/blog/bdpaygate-laravel-payment-gateway-bangladesh/) - License: MIT - Laravel: composer require byteminus/laravel-bdpaygate - Node.js: npm install bdpaygate - Supports: Laravel 11–13 · PHP 8.2–8.5 · Node.js 20.19+, Bun, Deno, Workers - Gateways: 12, with 7 run end to end on real sandboxes - Tests: 401 in Laravel, plus `BdPayGate::fake()` for yours - Docs: [bdpaygate.github.io](https://bdpaygate.github.io/) · [Node.js](https://bdpaygate.github.io/node/) - Source: [laravel-bdpaygate](https://github.com/byteminus/laravel-bdpaygate) · [bdpaygate-js](https://github.com/byteminus/bdpaygate-js) - Packages: [Packagist](https://packagist.org/packages/byteminus/laravel-bdpaygate) · [npm](https://www.npmjs.com/package/bdpaygate) - MIT license - Released - Blogging · AI · Laravel ## Laravel AI Blog The AI-native blog package for Laravel. It plans topics, drafts with you, scores every post for on-page SEO, links posts to each other and flags the ones going stale — and lets Claude, ChatGPT, Claude Code or any MCP agent write to it. - **Headless by default.** Models, migrations and a `HasBlogSeo` trait for your existing Post model. Turn on one flag for `/blog` routes, Blade components, RSS and JSON-LD. - **SEO scoring with plain-English fixes.** A deterministic on-page score and grade, internal-link suggestions with anchor text, stale-post detection, and BlogPosting and FAQPage structured data — no API key needed. - **AI as your editor, not your ghostwriter.** Built on the official `laravel/ai` SDK with any provider: keyword to brief to draft, meta descriptions, rewrites and translations. Everything lands as a draft. - **Agent-ready.** A `laravel/mcp` server with tools to list, draft, update, score, link and schedule posts — and deliberately no publish tool. - **Safe research.** A fetcher that blocks internal addresses and DNS rebinding, obeys robots.txt, and marks everything it fetches as untrusted before it reaches a model. - **One command bus.** Abilities, idempotency keys and an audit trail, so a dashboard, a job and an AI agent all follow the same rules. [View on GitHub](https://github.com/byteminus/laravel-ai-blog) [Packagist](https://packagist.org/packages/byteminus/laravel-ai-blog) [Launch post](https://byteminus.com/blog/laravel-ai-blog-package/) - License: MIT, no paid tier - Install: composer require byteminus/laravel-ai-blog - Supports: Laravel 10–13 · PHP 8.2–8.5 - AI (optional): laravel/ai · laravel/mcp - Works without AI: Scoring, links, schema, RSS and routes - Source: [github.com/byteminus/laravel-ai-blog](https://github.com/byteminus/laravel-ai-blog) - Package: [packagist.org/packages/byteminus/laravel-ai-blog](https://packagist.org/packages/byteminus/laravel-ai-blog) - MIT license - Source release in progress - Education ## EduByte The school operating platform for Bangladesh’s institutions. One system for attendance, marks, fees, notices and guardian communication — designed Bangla-first, and built to keep working on the connections classrooms actually have. - **Multi-tenant by design.** Every institution is a tenant. Every tenant-owned table carries forced PostgreSQL row-level security, and the application connects as a role that cannot bypass it. - **Isolation that is proven, not assumed.** `db:check-rls` fails the build if any tenant table lacks a policy, and `db:isolation-check` tries to read and write across two institutions and fails on any finding. - **Offline-first staff app.** A Next.js PWA with an IndexedDB outbox, so attendance and marks can be recorded without a connection and synced later. - **Guardians in the loop.** Signed guardian pages, one-time SMS codes and an Expo mobile app with push notifications that never show private details on a locked screen. - **Tamper-evident audit log.** Hash-chained records with `audit:verify` to walk the chain and report any break. - **Modular monolith.** Each feature area is a self-contained module, with architecture decisions recorded as ADRs. [Visit EduByte](https://edubyte.byteminus.com/) [Read the launch post](https://byteminus.com/blog/introducing-edulab-open-source-school-platform/) [How tenancy works](https://byteminus.com/blog/postgresql-row-level-security-multi-tenant-laravel/) - License: MIT - API: Laravel 12 · PHP 8.3 - Staff app: Next.js 15 · TypeScript · Dexie - Mobile: Expo React Native - Data: PostgreSQL 16 · Redis/Valkey - Run locally: Docker Compose, one command - Tests: Pest · Vitest · Playwright - Repository: Public release coming Go packages ## Eleven Go packages for SaaS backends. The pieces every multi-tenant product needs and nobody wants to write twice — tenancy, permissions, approvals, audit, settings, flags, translations, files, notifications, backups and an admin panel — as small, separate modules. Each is MIT-licensed, needs Go 1.26 or later, and those that store data do it in PostgreSQL through pgx v5. All are at v0.2.0: usable today, with the API still free to change before 1.0. [Read the launch post](https://byteminus.com/blog/go-packages-for-saas-backends/). - MIT - v0.2.0 - Multi-tenancy ### go-tenancy Tenants, memberships and invitations, isolated in Postgres. Tenants with slugs and custom domains, memberships with a concurrency-safe last-owner guard, single-use invitations stored only as hashes, middleware that resolves each request’s tenant, and row-level security inside shared tables. `go get github.com/byteminus/go-tenancy` [GitHub](https://github.com/byteminus/go-tenancy) [Go docs](https://pkg.go.dev/github.com/byteminus/go-tenancy) - MIT - v0.2.0 - Access control ### go-permission Roles, wildcard permissions and typed policies. Ask `Can(ctx, user, "invoices.create", tenant)`. Roles per tenant or team, typed policy functions for rules that depend on the resource, and cached checks kept coherent across instances with `LISTEN/NOTIFY`. `go get github.com/byteminus/go-permission` [GitHub](https://github.com/byteminus/go-permission) [Go docs](https://pkg.go.dev/github.com/byteminus/go-permission) - MIT - v0.2.0 - Workflows ### go-approvals Multi-step approvals with separation of duties. Any, all or quorum steps, role-based approvers, deadlines and hooks. Requests snapshot their steps so a deploy never breaks work in flight, decisions are serialised with row locks, and hooks run in the same transaction. `go get github.com/byteminus/go-approvals` [GitHub](https://github.com/byteminus/go-approvals) [Go docs](https://pkg.go.dev/github.com/byteminus/go-approvals) - MIT - v0.2.0 - Audit ### go-activitylog Who changed what, in the same transaction as the change. Tag the fields you care about and every create, update and delete is recorded with its actor, tenant, request and field diff — secrets marked as changed without their values. Read it back as a feed, a record’s history or an actor’s trail. `go get github.com/byteminus/go-activitylog` [GitHub](https://github.com/byteminus/go-activitylog) [Go docs](https://pkg.go.dev/github.com/byteminus/go-activitylog) - MIT - v0.2.0 - Configuration ### go-settings Typed settings at global, tenant and user scope. Declare a `Key[T]` with a default and a rule; the most specific override wins. Secrets are encrypted at rest with rotating AES-256-GCM keys, and an in-process cache stays coherent across instances. `go get github.com/byteminus/go-settings` [GitHub](https://github.com/byteminus/go-settings) [Go docs](https://pkg.go.dev/github.com/byteminus/go-settings) - MIT - v0.2.0 - Releases ### go-featureflags Flags, targeting and sticky percentage rollouts. Evaluated against an immutable in-memory snapshot, so a request never waits on the database: kill switches, user and tenant targeting, attribute rules and weighted variants, refreshed by polling or pushed from Postgres. `go get github.com/byteminus/go-featureflags` [GitHub](https://github.com/byteminus/go-featureflags) [Go docs](https://pkg.go.dev/github.com/byteminus/go-featureflags) - MIT - v0.2.0 - Localisation ### go-translatable Multilingual jsonb fields with locale fallback. Translations live in your own tables as jsonb, with no extra tables or joins. BCP 47 fallback chains, request locale from the URL, a cookie or `Accept-Language`, and the same fallback applied inside SQL for sorting and filtering. `go get github.com/byteminus/go-translatable` [GitHub](https://github.com/byteminus/go-translatable) [Go docs](https://pkg.go.dev/github.com/byteminus/go-translatable) - MIT - v0.2.0 - Files ### go-medialibrary Attach validated uploads to models, with conversions. Uploads checked by their real content type, stored on a local disk or any S3-compatible bucket (S3, R2, MinIO), recorded in Postgres, with thumbnails made inline or through your own job queue. A record never points at a missing file. `go get github.com/byteminus/go-medialibrary` [GitHub](https://github.com/byteminus/go-medialibrary) [Go docs](https://pkg.go.dev/github.com/byteminus/go-medialibrary) - MIT - v0.2.0 - Messaging ### go-notifications Email, SMS, push and an in-app inbox, one dispatcher. A notification is a Go type that says how it renders per channel. The dispatcher respects opt-outs and reports what happened per recipient and channel. SMTP, Twilio and FCM are built in; the inbox is stored in Postgres. `go get github.com/byteminus/go-notifications` [GitHub](https://github.com/byteminus/go-notifications) [Go docs](https://pkg.go.dev/github.com/byteminus/go-notifications) - MIT - v0.2.0 - Operations ### go-backup Postgres and file backups, encrypted, verified, restorable. `pg_dump` and upload archives, encrypted with age, streamed to a local volume and S3-compatible storage at once, checksums verified, pruned grandfather-father-son. A backup is complete only once every byte and its manifest are stored. `go get github.com/byteminus/go-backup` [GitHub](https://github.com/byteminus/go-backup) [Go docs](https://pkg.go.dev/github.com/byteminus/go-backup) - MIT - v0.2.0 - Back office ### go-admin A server-rendered admin panel from Go definitions. Lists with search, filters and bulk actions, detail pages, validated forms and a dashboard, as a plain `http.Handler` with no code generation. It asks your authoriser before every page and write, and ships a strict Content-Security-Policy. `go get github.com/byteminus/go-admin` [GitHub](https://github.com/byteminus/go-admin) [Go docs](https://pkg.go.dev/github.com/byteminus/go-admin) Principles ## What you can expect from every project we release. ### Permissive licensing Use it, change it, run it commercially. We prefer the MIT license so nobody needs a lawyer to adopt our work. ### Decisions written down Architecture decision records explain why things are the way they are, so contributors don’t have to guess or reverse-engineer intent. ### Tests that mean something Continuous integration runs on every pull request, including checks for the properties that matter most, like tenant isolation. ### Runs on your machine Every project starts locally with a documented command or two, with demo data so you can see it working in minutes. ### Local by default We build for Bangladesh first: Bangla as people actually speak it, local payment rails and connections that drop. ### Small on purpose Fewer dependencies, fewer moving parts. The code we don’t ship is code nobody has to maintain. Coming next ## More projects on the way. We are preparing more of our internal tools and libraries for public release. Follow [byteminus on GitHub](https://github.com/byteminus) or subscribe to the [blog feed](https://byteminus.com/blog/feed.xml) to hear when they land. Contributing ## How to get involved. - ### Open an issue Found a bug or want a feature? Describe what you expected and what happened. Small, specific issues get fixed fastest. - ### Send a pull request Keep it focused, include a test, and make sure CI is green. We review every pull request and explain any change we ask for. - ### Report security issues privately Please email [contact@byteminus.com](mailto:contact@byteminus.com?subject=Security%20report) instead of opening a public issue. We’ll acknowledge it and keep you updated on the fix. - ### Tell us how you use it Running EduByte in your school? We’d like to hear what works and what doesn’t — it shapes what we build next. ## Questions about a project? Open an issue on the project’s GitHub repository, or email us. We don’t take client projects, but we read every message about our open-source work. [GitHub](https://github.com/byteminus) [contact@byteminus.com](mailto:contact@byteminus.com?subject=Open%20source)