Documentation for larsasub v0.12.0. On an older version? Your release notes ship with the package (CHANGELOG.md).

Licensing & repository#

This page explains how the license model works on the composer level: what the repository serves, how tokens behave, and what changes when a license expires or is renewed. For the install commands themselves, see Installation.

The update window#

A license gives you a 12-month update window, starting on the purchase date. The repository decides per version, by date:

A version is installable for you when it was released on or before your license's expiry date.

That rule is the whole model. While your window is open, every new release falls inside it and composer update picks it up. After the window closes, the versions released during it keep matching the rule, so they stay installable indefinitely: on new servers, in CI, after a fresh composer install without a lock file. Releases are immutable; a version that was once served to you is never rewritten or withdrawn.

There is no phone-home in the package itself: applications running LarsaSub never contact larsasub.eu, and that is not going to change. Access to releases is enforced here, at the repository, at install time. The package additionally reads one local setting — the tier you declare — and refuses to run Mollie Connect on a tier that does not cover it. That is a check against a value you wrote yourself, on your own server; nothing about it is sent anywhere. It is described under "How the tier is checked" below.

Tokens#

Repository access authenticates with your account e-mail plus a license token. Tokens are managed under Licenses in the customer portal:

• Create as many tokens as you need. One per environment (production, staging, CI) is a sensible default: revoking one never breaks the others.
• A token's plain value is shown exactly once, at creation. Store it in your secrets manager; the portal only keeps a hash.
• Revoking a token takes effect immediately. Running applications are unaffected, since the package never calls home; only new composer install/update runs need a valid token.

Tokens may be used anywhere within your organization, but not shared outside it; see the terms.

Expiry and renewal#

When your license expires:

• Nothing installed changes. Deployed applications keep running; locked versions keep installing.
• composer update resolves to the newest version inside your window instead of the newest version overall.
• Releases published after your expiry date report as unavailable until you renew.

Renewing extends the window by 12 months from your current expiry date. If your license already lapsed, the new window starts on the day you renew, and everything released during the gap becomes available as well: there is no penalty for renewing late, other than not having had the releases in between.

Continuity: what happens if we stop#

A proprietary package puts you in a position an open-source one does not: if the vendor disappears, you hold code you are not allowed to fork. Billing is the wrong layer to carry that risk, so the terms bound it.

Your license, and the versions you already hold under it, convert to the MIT license — free to fork, modify and redistribute — if any of these happens:

• we announce that LarsaSub is discontinued;
• we cease trading, are dissolved, or enter insolvency;
• a security report to security@larsasub.eu goes unanswered for 90 days;
• a new major Laravel release breaks compatibility, and 6 months later there is neither a compatible release nor a dated statement that one is coming.

The last two are rebutted by a dated maintenance statement published here.

Three things worth being precise about. A quiet period is not a trigger. A year with no releases, no unanswered security report and no breaking Laravel release means nothing needed fixing — that is the package working, not the vendor leaving. The clause covers what you hold, not what comes after: it is an exit, not a way to obtain releases from outside your update window. And it does not apply to a license deactivated for abuse under section 7 of the terms (token sharing, redistribution, a chargeback on a paid invoice).

You already have the source — it is a composer package sitting in your vendor directory, and you can read every line of it before you buy. What the license withholds is the right to fork it. This clause returns exactly that right, exactly when you would need it.

Errors you might see#

Which license do I need?#

• Single: one production Laravel application. Development, staging and CI copies of that application are included.
• Unlimited: any number of applications operated by you, including client projects you build and operate.
• Platform: everything in Unlimited, plus the right to collect payments on behalf of others.

The line between Unlimited and Platform is not how many applications you run — it is whose Mollie account the money lands on.

Billing your own customers is Unlimited, however many applications you spread it over, and whether or not those applications are multi-tenant. A SaaS with ten thousand tenants that settles everything to its own Mollie account is an Unlimited case.

Onboarding other merchants, so that payments settle to their Mollie accounts and you take an application fee, is Platform. That is what the Mollie Connect features are for: connected accounts, OAuth onboarding, application fees, dual billing and tenant-scoped plans and mandates. In the package this is the larsasub.connect.enabled switch — with it off, every payment goes to your own account and application fees are never applied.

Platform also comes with priority support: a response within one business day, direct from the developer.

Current prices are on the pricing page. All three tiers include the larsasub-nova and larsasub-filament admin companions at no extra cost, and all follow the same update-window rules above.

How the tier is checked#

Barely, and never by us.

The package reads one setting, larsasub.license.tier, and refuses to start when Mollie Connect is enabled on anything other than platform. That is the entire mechanism. The value is one you write yourself: nothing verifies it, nothing signs it, and nothing about it is transmitted, so we cannot see what it says. You could type platform without holding one and everything would work.

That is not an oversight, it is the design. The gate is a signature line, not a lock. It turns "Connect got switched on" into "somebody wrote down a license they do not hold" — two very different things to have a conversation about, and only the second one is worth writing terms about. What the gate does not do is tell us anything. We still do not scan, probe or crawl customer applications, and a production URL registered with us would tell us nothing about whose Mollie account a payment settled to anyway. The tier rests on what you tell us.

So that this is not simply an honour system with nothing behind it, the terms give us exactly one thing: the right to ask. On written request you send us, within 30 days, a statement of which production applications run LarsaSub and whether payments in any of them settle to a Mollie account that is not yours. Not access to your servers, not your source code, not your customers' data — a statement. We will not ask more than once in twelve months unless something concrete suggests the tier is wrong.

If it turns out you need a higher tier, you have 30 days to upgrade by paying the difference between the two, going forward. We do not send a bill for the months before the question was asked; getting the tier wrong is usually a misreading of where the Unlimited/Platform line sits, and that is our sentence to write clearly, not your mistake to pay for. Refusing to answer, or answering something you know to be untrue, is a different matter and falls under the abuse clause in section 7.

Your renewal price does not move#

The price to renew is fixed when you buy, recorded on your license, and shown under Licenses in the customer portal. If we raise our list prices later, your renewal stays where it was. Raising a published price is a decision about new customers; it is not a bill we send to the people who already trusted us.