README

PHPStan integration for Moduark. It reports Moduark module-boundary violations in PHPStan without running Moduark's standalone parser a second time.

This package is under initial development. The first slice supports only internal_api_access / MOD-BOUNDARY-001.

Requirements

PHP 8.2 or newer
Moduark 0.4 or 0.5 beta
PHPStan 2.2
Laravel 12 or 13 through the installed Moduark package

Larastan is supported but optional.

Installation

Install the Moduark beta as an application dependency, then install this extension as a development dependency:

composer require cluion/moduark:^0.5@beta
composer require --dev cluion/moduark-phpstan:^0.1@beta

If the application already requires cluion/moduark:^0.4@beta or cluion/moduark:^0.5@beta, only the second command is needed. A dependency's stability flag does not relax the consuming application's Composer stability constraints, so a clean project must declare the Moduark beta explicitly.

When phpstan/extension-installer is installed, Composer discovers extension.neon automatically. Otherwise include it manually:

includes:
    - vendor/cluion/moduark-phpstan/extension.neon

Configuration

The extension deliberately does not boot Laravel. Its defaults match a standard Moduark application:

parameters:
    moduark:
        basePath: %currentWorkingDirectory%
        modulesPath: %currentWorkingDirectory%/app/Modules
        rootNamespace: App\Modules
        configPath: %currentWorkingDirectory%/config/modules.php
        baselinePath: %currentWorkingDirectory%/moduark-baseline.json
        suppressionsPath: %currentWorkingDirectory%/moduark-suppressions.json
        internalApiAccess:
            enabled: true
            severity: error

config/modules.php remains optional, matching Moduark itself. When the file is present it participates in cache invalidation; effective PHPStan settings still come from the explicit moduark block above.

Keep internalApiAccess.enabled and severity aligned with the effective config/modules.php architecture level and rule override. A warning remains visible through php artisan module:check; it does not become a blocking PHPStan error.

Active Moduark baseline and suppression entries are applied before PHPStan errors are produced. Remaining violations are non-ignorable in PHPStan; use Moduark's audited suppression manifest instead of ignoreErrors.

Current diagnostic

Moduark rule	Code	PHPStan identifier
`internal_api_access`	`MOD-BOUNDARY-001`	`moduark.internalApiAccess`

config/modules.php, the baseline, the suppression manifest, and Module entry metadata participate in PHPStan result-cache invalidation.

Development

composer verify
composer test:compatibility
composer test:compatibility -- --moduark-path=/path/to/moduark

The integration suite compares PHPStan output with Moduark's standalone rule and runs the same fixture with and without Larastan. The default compatibility run keeps the released Moduark 0.4 beta covered; --moduark-path maps an explicit checkout to the upcoming 0.5 beta version for pre-release verification.

cluion / moduark-phpstan

Maintainers

Package info

Statistics

Security