Download the PHP package php-concept/core without Composer

Concept Core

Concept Core is an aesthetic, strict-typed PHP engine built on PSR standards.

A strict-typed PHP application engine for builders who want ergonomics without the monolith.

Concept Core is the foundation of the Concept stack: a lean, PSR-native runtime that wires routing, DI, validation, database access, views, and CLI into a coherent whole — then gets out of your way. Applications are assembled from components: self-contained modules that ship their own routes, migrations, seeders, views, assets, and service providers.

Built for PHP 8.4+, every public API uses declare(strict_types=1) and is designed to be extended, not overridden.

No magic — no hidden conventions you cannot grep for.

Why Concept Core?

Concept Core is not a CMS and not a full-stack framework. It is an engine: opinionated where it matters (request lifecycle, validation, errors), flexible everywhere else (authorization, business logic, UI).

Architecture at a glance

Request flow

1. App boots service providers; ComponentsServiceProvider registers component routes, migrations, seeders, views, and commands.
2. Router matches a route; middleware runs (CSRF, validation handler, view data, …).
3. RouteStrategy invokes the handler: route interceptors first, then autowiring (FormRequest validation, route-param casting, ServerRequestInterface).
4. Controller returns a PSR-7 response; SapiEmitter sends it.

Tech stack

Quick start

Install

Requires PHP 8.4+ and extensions: pdo, json, mbstring, dom, xml.

Minimal bootstrap

Front controller (public/index.php)

Console entry (bin/console.php)

Components — the killer feature

A component is a vertical slice of your application: routes, providers, migrations, seeders, views, console commands, and publishable assets — bundled behind one class.

Register the component class in config (resolved from the container via ReflectionContainer):

ComponentsServiceProvider automatically:

• loads each component's routes() file into the router;
• registers component service providers;
• merges migration paths and seeder classes into registries;
• attaches Twig extensions and view namespaces;
• registers console commands;
• maps URL prefixes to view contexts (e.g. /admin → dashboard layout).

ComponentInterface methods:

Ship a feature once. Reuse it in every project.

HTTP layer

Routing

Routes live in plain PHP files. League Route gives you groups, middleware, and named routes:

Generate URLs anywhere:

List routes from CLI:

RouteStrategy — autowiring that actually helps

The controller instance is resolved from the container (constructor injection via ReflectionContainer). Action method parameters are filled by RouteStrategy:

No manual $request->getAttribute('id') boilerplate for route parameters.

Route interceptors

Pre-controller hooks configured in config/routes.php:

Throw your own exceptions; core stays agnostic. Pair with middleware like HandleValidationExceptionMiddleware for redirects and JSON errors.

Built-in middleware

Response factory

Validation & DTOs

FormRequest

In the controller:

Features:

• Rakit rules with custom rule registration via config;
• localized messages from {validator_translations}/{locale}.php (path mapped in bootstrap/paths.php, typically resources/lang/validator);
• field aliases and per-request message overrides;
• automatic CSRF field exclusion;
• optional validation payload logging (masked).

Valinor casting

Route parameters and DTOs are mapped with Valinor — cached mappers, scalar coercion, superfluous key tolerance. Route-param cast failures throw CastingException; DTO mapping via FormRequest::toDto() wraps failures as ValidationCastException.

Database

Illuminate Capsule + Eloquent without the Laravel kernel:

• fluent query builder and Eloquent models;
• migrations via Illuminate\Database\Migrations\Migrator;
• seeders aggregated from app + components;
• pagination wired to the current request URI;
• optional SQL query logging to Monolog.

CLI

Migrations and seeders from all registered components are merged automatically.

Views

Switch engines via service provider — register one of:

• TwigServiceProvider (.twig, compiled cache in production)
• PlatesServiceProvider (.php templates)

Namespaces & contexts

App-level config (config/view.php) or component viewPaths() / viewContexts() / viewExtensions():

Render:

ShareViewDataMiddleware injects errors, old, flashes, and csrf_token into every view.

Configuration

PHP config files merged via Noodlehaus Config. Canonical keys live in Concept\Core\Foundation\ConfigKey:

• app.name, app.debug, app.version, app.locale, app.fallback_locale, app.timezone
• db.*, session.*, log.* (log.db_queries, log.validation_data)
• routes.list, routes.interceptors
• components, commands, migrations.paths, migrations.table, seeders.list
• view.paths, view.contexts, view.extensions, view.cache_dir, view.default_extension
• validator.rules, masking.*, telemetry.enabled

.env support through vlucas/phpdotenv in the application skeleton.

Security

• CSRF — token generation, session storage, middleware verification, shared as csrf_token view global.
• Session — secure cookie options (lifetime, SameSite, HttpOnly, strict mode).
• Data masker — redact passwords, tokens, and custom patterns before they hit logs.
• Validation whitelist — validated() returns only keys defined in rules().

Authorization (ACL, policies, gates) is intentionally application-level via route interceptors and middleware — core provides the hook, you bring the rules.

Error handling

Errors are handled from the first line of bootstrap:

All paths log through PhpErrorLogHandler → Monolog. Before providers boot, early failures use resources/views/errors/fallback/500.php. Production handler never leaks stack traces to users.

Telemetry

When telemetry.enabled is true, the framework records bootstrap milestones:

• service provider awakening;
• component registration;
• per-route controller invocation timing.

Useful for debug bars and performance profiling. Access via TelemetryCollector in the container.

Logging

Monolog with rotating file handler (storage/logs). Configurable level, retention, and channel name. Database queries and validation payloads can be logged with automatic masking.

Locale

LocaleServiceProvider resolves the active locale from config or a custom LocaleResolverInterface (app.locale_resolver). Validation messages load from {validator_translations}/{locale}.php with app.fallback_locale fallback.

Service providers (built-in)

Providers live under Concept\Core\Providers\{Group}\*.

Register only what you need in bootstrap/providers/app.php.

Console commands (core)

Components can register their own commands the same way.

Development

The core ships with 70+ test classes covering routing, validation, providers, middleware, Whoops integration, and component boot sequences.

Design principles

1. Strict types everywhere — fewer surprises at runtime.
2. PSR first — interoperable HTTP, container, middleware.
3. Composition over inheritance — components and providers, not base controller magic.
4. Explicit configuration — no hidden conventions you cannot grep for.
5. Fail loud in dev, safe in prod — Whoops vs fallback views.
6. Batteries included, swappable — Twig or Plates.

Project layout (application skeleton)

Read the Documenation

License

MIT © Concept Framework contributors.

Concept Core — small kernel, sharp edges, infinite composition.
Build the app. Ship the component. Repeat.