ForgeStack ships every piece of Mexico's compliance stack as tested, typed PHP packages. Symfony and Laravel. CFDI 4.0, four payment gateways, subscription billing with IVA — all in one place.
CFDI 4.0 requires offline XSLT chain-of-origin signing, DER-encoded CSD key decryption, and PAC connectivity. Most first implementations have subtle signing errors that only surface at scale — after your customers are already affected.
MercadoPago, Conekta, and Pagar.me each use completely different signature schemes. One wrong implementation means missed payments, duplicate processing, or accepting forged webhooks in production.
Safe billing requires three independent layers — advisory lock, unique constraint, and a deterministic idempotency key — to survive any crash or retry scenario. Getting this wrong is expensive in every sense.
Each module ships with Symfony and Laravel bridges and can be purchased independently or as a bundle.
Generating a valid CFDI requires more than building an XML string. SAT's chain-of-origin algorithm, encrypted CSD private keys, and live PAC connectivity all have to be exactly right — or the stamp is rejected. We've already solved every one of these problems and written the tests.
OXXO references, SPEI CLABEs, Pix QR codes, Boleto, and card charging — all behind a single PHP interface. Switch gateways or support multiple at once without rewriting business logic.
Most billing libraries ignore the LATAM reality: every invoice needs IVA calculated correctly, a CFDI stamped before the charge, and an OXXO voucher delivered if the customer pays cash. This package handles all of it — correctly.
Send OXXO vouchers, payment reminders, trial warnings, and stamped CFDI PDFs directly via WhatsApp. Works with Meta Cloud API and Twilio. Wires automatically to billing and payment events.
RFC validation with SAT's Modulo-11 check digit algorithm, catalog lookups across all 6 SAT catalogs (52K+ c_ClaveProdServ entries), and CSD certificate metadata parsing. Zero runtime API calls.
Mexico postal code → colonia, municipio, and estado. All 32 estados, 68K+ postal codes. Compiled from SEPOMEX's public data into an embedded SQLite database. No API calls, no rate limits, no account required.
Every task in this stack was executed using Claude Opus — Anthropic's most capable model — running Claude Code's subagent-driven development: structured plans with test-first discipline, PHPStan level 8, and PSR-12 on every file. The AI handles the implementation volume; the architecture, security decisions, and integration contracts are designed and supervised by Ruben E. — a PHP-Symfony engineer with 25+ years building production systems.
That combination is hard to replicate: AI speed and consistency at scale, grounded by senior engineering judgment that catches what models miss — subtle invariants, edge-case security concerns, and architectural decisions that hold up past the first deploy.
Join the WaitlistSecurity is a first-class constraint across every ForgeStack module — not a post-launch patch. Each of the OWASP Top 10 attack vectors is blocked at the architectural level: in the ORM, the type system, the webhook verification pipeline, and the secrets vault. Senior-engineered, AI-assisted, and audited before every release. In a world where AI-generated attack tooling ships as fast as AI-generated code, verified security posture is the difference between production-grade and demo-grade.
Doctrine ORM parameterized queries throughout — no raw SQL, no string interpolation in any query path. PHPStan level 8 flags injection-prone patterns at static analysis time, before they reach a test suite or a production server.
Signatures are verified before the body is ever parsed — always, no exceptions. MercadoPago HMAC-SHA256, Conekta RSA public key, Pagar.me IP allowlist. Constant-time comparison on every gateway. Tampered or replayed payloads are rejected at the perimeter.
PciGuard::scrub() runs on every log write path — card numbers and API keys never appear in logs or traces. HTTPS-only is enforced at driver construction time, not by convention. Non-compliance throws at boot, not in production at 2 AM.
Three-layer idempotency on all charge paths — advisory lock, unique constraint, deterministic key — makes replay attacks on payment endpoints structurally impossible. Unsigned webhook payloads never reach business logic.
CFDI private keys sign inside the KMS — they never leave the vault as raw bytes. Stored credentials use envelope encryption. A compromised app container gains zero access to signing material or payment secrets.
PHP 8.2 strict types, readonly DTOs, and PHPStan level 8 eliminate entire categories of type-confusion exploits before runtime. Final classes block unexpected inheritance. The type system is the first line of defense, not just documentation.
Join the waitlist and get early access pricing when we launch. We'll notify you as each module ships — no spam, unsubscribe anytime.
No credit card required. Waitlist members receive early access pricing.