README

PHPStan integration for Moduark. It reports Moduark module-boundary violations in PHPStan without running Moduark's standalone parser a second time.

The stable 0.2 line supports the internal_api_access / MOD-BOUNDARY-001 diagnostic. Other Moduark architecture rules are not yet integrated with PHPStan.

The 0.3.0-beta.1 prerelease also integrates undeclared_dependencies / MOD-DEPENDENCY-002. It is opt-in while stable installations remain on ^0.2.

Requirements

PHP 8.2 or newer
Moduark 1.x
PHPStan 2.2
Laravel 12 or 13 through the installed Moduark package

Larastan is supported but optional.

Installation

Install stable Moduark as an application dependency, then install this extension as a development dependency:

composer require cluion/moduark:^1.0
composer require --dev cluion/moduark-phpstan:^0.2

If the application already requires cluion/moduark:^1.0, only the second command is needed.

To evaluate the new declared-dependency diagnostic, install the exact prerelease explicitly:

composer require --dev cluion/moduark-phpstan:0.3.0-beta.1

Applications remaining on Moduark 0.4 or 0.5 beta must remain on the companion ^0.1@beta line, whose configuration cache input is config/modules.php.

When phpstan/extension-installer is installed, Composer discovers extension.neon automatically. Otherwise include it manually:

includes:
    - vendor/cluion/moduark-phpstan/extension.neon

Configuration

The extension deliberately does not boot Laravel. Its defaults match a standard Moduark application:

parameters:
    moduark:
        basePath: %currentWorkingDirectory%
        modulesPath: %currentWorkingDirectory%/app/Modules
        rootNamespace: App\Modules
        configPath: %currentWorkingDirectory%/config/moduark.php
        baselinePath: %currentWorkingDirectory%/moduark-baseline.json
        suppressionsPath: %currentWorkingDirectory%/moduark-suppressions.json
        internalApiAccess:
            enabled: true
            severity: error
        undeclaredDependencies:
            enabled: true
            severity: error

config/moduark.php remains optional, matching Moduark itself. When the file is present it participates in cache invalidation; effective PHPStan settings still come from the explicit moduark block above.

The extension does not boot Laravel, so nwidart applications must align their Module root and namespace explicitly:

parameters:
    moduark:
        modulesPath: %currentWorkingDirectory%/Modules
        rootNamespace: Modules

The <Module>/app source root is then detected from analyzed file paths. app/Contracts, app/Data, and app/Events remain public while sibling implementation directories remain internal.

Keep each rule's enabled and severity values aligned with the effective config/moduark.php architecture level and rule overrides. A warning remains visible through php artisan moduark:check; it does not become a blocking PHPStan error.

Active Moduark baseline and suppression entries are applied before PHPStan errors are produced. Remaining violations are non-ignorable in PHPStan; use Moduark's audited suppression manifest instead of ignoreErrors.

Current diagnostics

Moduark rule	Code	PHPStan identifier	Availability
`internal_api_access`	`MOD-BOUNDARY-001`	`moduark.internalApiAccess`	Stable `0.2`
`undeclared_dependencies`	`MOD-DEPENDENCY-002`	`moduark.undeclaredDependency`	Prerelease `0.3.0-beta.1`

config/moduark.php, the baseline, the suppression manifest, and Module entry metadata participate in PHPStan result-cache invalidation.

Development

composer verify
composer test:compatibility
composer test:compatibility -- --moduark-path=/path/to/moduark
composer test:compatibility -- --package=0.2.0

The integration suite compares PHPStan output with Moduark's standalone rule and runs the same fixture with and without Larastan. The default compatibility run uses the published stable Moduark 1.x line; --moduark-path maps an explicit checkout to 1.0.x-dev for pre-release verification. The --package mode validates an exact published moduark-phpstan version instead of the local checkout and is intended for post-release acceptance.

cluion / moduark-phpstan

Package info

Security

Statistics