Download the PHP package timefrontiers/php-core without Composer

TimeFrontiers PHP Core

Core utilities, enums, and helpers for TimeFrontiers packages.

Installation

Requirements

• PHP 8.5+
• ext-curl, ext-json, ext-libxml, and ext-simplexml
• timefrontiers/php-has-errors ^1.0
• timefrontiers/php-validator ^1.1.1
• giggsey/libphonenumber-for-php ^8.13 (for Phone utilities — installed automatically)

Package Contents

AccessRank Enum

User access levels for permission control and error visibility filtering.

Rank Values

AccessGroup Enum

String-backed version of AccessRank for database storage.

HttpStatus Enum

HTTP status codes with helper methods.

Http Utilities

Request Handling

verifyCSRF() never infers login state and never reads globals. Verification fails when no adapter is present. The generateCSRF() and csrfField() static helpers remain deprecated compatibility adapters and also require an explicitly supplied/configured manager.

Http Client

cURL-based HTTP client for making API requests.

The default client accepts only HTTP(S), resolves every hop, rejects multicast and every IANA special-purpose/non-global address class, and pins approved DNS answers for the transport hop. Redirects are handled manually so every destination is revalidated. A single monotonic total deadline covers DNS and all redirect hops; synchronous platform DNS cannot be interrupted mid-call, but its elapsed time is charged and transport is skipped when it exhausts the budget.

Cross-origin redirects retain only a small standard content-negotiation allowlist. Authorization, cookies, AWS session tokens, API keys, client secrets, and caller-defined headers are removed by default. A caller-owned nonstandard field requires explicit allowCrossOriginHeaders() opt-in. Non-idempotent bodies are not replayed unless allowNonIdempotentRedirects() is explicitly enabled.

Trusted server-side callers that deliberately need an internal destination can inject UrlPolicy::trusted(). This is the low-level opt-out; the default policy must be used for request-derived URLs. ClientResponse::toArray() is a safe metadata projection. Use toDebugArray() only in trusted diagnostics because it includes the body, headers, and transport context. ClientResponse::xml() accepts UTF-8 only (with an optional UTF-8 BOM) and rejects DTD/entity-bearing, malformed, unsupported-encoding, and oversized documents.

Http Header

HTTP header utilities for responses.

Time (Date/Time Utilities)

Date and time formatting and manipulation.

URL Utilities

String Utilities

Need random strings? Use TimeFrontiers\Data\Random from timefrontiers/php-data — it's CSPRNG-backed with alphanumeric, hex, base64, uuid, numeric, and more. Str::random no longer exists in php-core.

Phone Utilities

Static wrapper around giggsey/libphonenumber-for-php for parsing, validating, formatting, and geolocating phone numbers. Every method returns null (or false for is* checks) on failure — no exceptions thrown.

Formatting

Country & continent lookup

Supported continents: Africa, Asia, Europe, North America, South America, Oceania, Antarctica. The internal map covers all 249 ISO 3166-1 alpha-2 codes.

Line type & carrier

Possible type() values: mobile, landline, fixed_or_mobile, toll_free, premium_rate, shared_cost, voip, personal_number, pager, uan, voicemail, unknown.

Validation

Structured parse

One call returning everything at once — handy for logging or API responses:

Normalization

Cheap, no libphonenumber needed — useful as a pre-store cleanup:

Development gate

Because Core now declares its existing HasErrors use directly while released php-has-errors 1.0.0 still requires Core, this package checkout must advertise the candidate version when Composer solves development dependencies:

The CI workflow sets COMPOSER_ROOT_VERSION itself. A normal consuming project does not need this environment variable; Composer resolves the two released packages together.

License

MIT License