Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:127405
Precedence: bulk
MIME-Version: 1.0
References: <CADK1yXKg1xpneLs3vJ=nUAAGaVuBhqkEMgbBVaYfcBfQL2vkDg@mail.gmail.com>
 <3ae9a6ea-f135-472b-b2bf-e6cd6ebad299@app.fastmail.com> <CAEUnE0d8QADSYv+OJMEceN4hdJNcNy=-GLvW-ZoNqoi6_2Lhxw@mail.gmail.com>
 <9A26F72B-D0EF-414F-B193-BED3CAB26A0B@rwec.co.uk> <9f6a0d6e-27c3-4f77-aed6-e55147442b6f@app.fastmail.com>
 <B46C391D-2248-4E54-BFBE-2195FFB6A2A5@rwec.co.uk> <ca5c49c9-948a-48f0-8b94-86fea583fbc4@app.fastmail.com>
 <673fd2db-b07f-439b-a4f2-e9519108d159@app.fastmail.com>
In-Reply-To: <673fd2db-b07f-439b-a4f2-e9519108d159@app.fastmail.com>
Date: Tue, 20 May 2025 10:04:49 -0400
Message-ID: <CAEUnE0dxRwjhKC64XHWkF3bNRLgjkgSJ9oMajRPfwLoDWy3x-g@mail.gmail.com>
Subject: Re: [PHP-DEV] Module or Class Visibility, Season 2
To: internals@lists.php.net
Content-Type: multipart/alternative; boundary="000000000000ec8268063591bb16"
From: tendoaki@gmail.com (Michael Morris)

--000000000000ec8268063591bb16
Content-Type: text/plain; charset="UTF-8"

The Problem: Interoperability.

That's really it.  Scenario
Alice provides whatchamacallit A that depends on other whatchamacallit D to
work.
Bob provides whatchamacallit B that also depends on D.
Charles is using A and B.
D gets updated with a new incompatible API to its prior version.
Alice publishes an update which includes a security fix.
Bob retired.
Charles, who can't program, can't update to Alice's latest code. His site
eventually gets pwned.

That's the problem. Packages with dependencies are not interoperable at
this time. They must be self contained. This is why WordPress doesn't
support Composer at all.

Drupal, Laravel et al bypass this problem by forcing all their
whachamacallits to stay on the same version. This has limited their market
penetration compared to WordPress because, despite being significantly
superior codebases in all respects, they aren't user friendly to someone
who doesn't code at all.


The Solution (10,000 overview)
Composer could be made to allow interoperable packages, but it will need
support at the language level to do so.  Specifically, it needs to know who
wants what. It can then make decisions based on that information.

Composer's primary link to the language is the autoload closure it
provides. That closure currently takes one argument - the fully qualified
name of the symbol to be loaded - currently almost always classes as for
various reasons function autoloading isn't a thing.  Can it not take a
second argument to modify its behavior?  The current behavior is to flat
require the file if it is found in accordance to whichever schema is in
use.  Perhaps we don't want that anymore - perhaps we want to return the
file path to use. This allows the engine to make decisions about how
exactly to include the file, including the possibility of monkey typing it
as can be done in userland, though when done in userland this effectively
generates a new package.


(5,000 ft. overview)
Suppose we have a whatchamacallit that declares its namespace as a new root
independent of / .  If a file inclusion happens in this namespace, this
namespace prepends everything in the included file. So if I do a file
include in the \MyPlugin namespace and that file declares its namespace as
Twig, it will become \MyPlugin\Twig.

That works, but direct file include is no longer the PHP norm though.
Autoloading is. So we need to tell the Autoloader that we want a file path
returned - do NOT require the file yourself in your namespace.  This could
be as simple as a boolean flag of true sent to the autoloader. BUT it isn't
- the autoloader (usually composer) needs to know the identity of this
requestor because by configuration in the package json (the details of
which are wildly out of scope) it might change which file path it returns.

When the engine gets the path it does the include and the prepending
business on the fly that Strauss and similar packages already do
in userland.

(2,500 ft overview)

The above I think would more or less work, but it would lead to massive
code duplication as Whatchamacallit A and B now have their own D's at \A\D
and \B\D (assuming namespaces match whatchamacallit names).

Here's what I think would prevent that:

A asks the autoloader for D. The autoloader returns a file path and the
engine mounts to \D
B asks for D. The autoloader returns a different file path so the engine
mounts to B\D and rewrites the D file with the new namespace the same way
Stauss would have done.

This works except for the problem of who had the older version, A or B? and
what order are A and B going to be asking - cause depending on the
application's architecture this order is not guaranteed.

To solve this the autoloader can tell the engine it is safe to mount the
file on root using an array return of [path, true] and mount on the
whatchamacallit's namespace if [path, false]. So

A asks for D. Autoloader returns [path, false]. Engine maps to \A\D and
monkey types D as needed.
B asks for D. Autoloader returns [path, true]. Engine maps to \D

Non whatchamacallit code at namespace C asks for D. It will get the same
version B is using and the autoloader shouldn't be queried unless C makes
this ask before B.

When C asks the autoloader gets (string RequestedSymbol, null) so it can
either do the require itself or return a string, either will work (and it
has to be this way for backwards compat).
When B asks the autoloader gets ( Requested, 'B' ) and it should return
[path, true]


I hope the above is followable. It's more of a morning brainstorm than a
spec.

--000000000000ec8268063591bb16
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div>The Problem: Interoperability.=C2=A0</div><div><br></=
div><div>That&#39;s really it.=C2=A0 Scenario=C2=A0</div><div>Alice provide=
s whatchamacallit A that depends on other whatchamacallit D to work.=C2=A0<=
/div><div>Bob provides whatchamacallit B that also depends on D.</div><div>=
Charles is using A and B.</div><div>D gets updated with a new incompatible =
API to its prior version.</div><div>Alice publishes an update which include=
s a security fix.</div><div>Bob retired.</div><div>Charles, who can&#39;t p=
rogram, can&#39;t update to Alice&#39;s latest code. His site eventually ge=
ts pwned.</div><div><br></div><div>That&#39;s the=C2=A0problem. Packages wi=
th dependencies are not interoperable at this time. They must be self conta=
ined. This is why WordPress doesn&#39;t support Composer at all.</div><div>=
<br></div><div>Drupal, Laravel et al bypass this problem by forcing all the=
ir whachamacallits=C2=A0to stay on the same version. This has limited their=
 market penetration compared to WordPress because, despite being significan=
tly superior codebases in all respects, they aren&#39;t user friendly to so=
meone who doesn&#39;t code at all.</div><div><br></div><div><br></div><div>=
The Solution (10,000 overview)</div><div>Composer could be made to allow in=
teroperable packages, but it will need support at the=C2=A0language level t=
o do so.=C2=A0 Specifically, it needs to know who wants what. It can then m=
ake decisions based on that information.</div><div><br></div><div>Composer&=
#39;s primary link to the language is the autoload closure it provides. Tha=
t closure currently takes one argument - the fully qualified name of the sy=
mbol to be loaded - currently almost always classes as for various reasons =
function autoloading isn&#39;t a thing.=C2=A0 Can it not take a second argu=
ment to modify its behavior?=C2=A0 The current behavior is to flat require =
the file if it is found in accordance to whichever schema is in use.=C2=A0 =
Perhaps we don&#39;t want that anymore - perhaps we want to return the file=
 path to use. This allows the engine to make decisions about how exactly to=
 include the file, including the possibility of monkey typing it as can be =
done in userland, though when done in userland this effectively generates a=
 new package.</div><div><br></div><div><br></div><div>(5,000 ft. overview)<=
/div><div>Suppose we have a whatchamacallit that declares its namespace as =
a new root independent of / .=C2=A0 If a file inclusion happens in this nam=
espace, this namespace prepends everything in the included file. So if I do=
 a file include in the \MyPlugin namespace and that file declares its names=
pace as Twig, it will become \MyPlugin\Twig.</div><div><br></div><div>That =
works, but direct file include=C2=A0is no longer the PHP norm though. Autol=
oading is. So we need to tell the Autoloader that we want a file path retur=
ned - do NOT require the file yourself in your namespace.=C2=A0 This could =
be as simple as a boolean flag of true sent to the autoloader. BUT it isn&#=
39;t - the autoloader (usually composer) needs to know the identity of this=
 requestor because by configuration in the package json (the details of whi=
ch are wildly out of scope) it might change which file path it returns.</di=
v><div><br></div><div>When the engine gets the path it does the include and=
 the prepending business on the fly that=C2=A0Strauss and similar packages =
already=C2=A0do in=C2=A0userland.</div><div><br></div><div>(2,500 ft overvi=
ew)</div><div><br></div><div>The above I think would more or less work, but=
 it would lead to massive code duplication as Whatchamacallit A and B now h=
ave their own D&#39;s at \A\D and \B\D (assuming namespaces match whatchama=
callit=C2=A0names).</div><div><br></div><div>Here&#39;s what I think would =
prevent that:</div><div><br></div><div>A asks the autoloader for D. The aut=
oloader returns a file path and the engine mounts to \D</div><div>B asks fo=
r D. The autoloader returns a different file path so the engine mounts to B=
\D and rewrites the D file with the new namespace the same way Stauss would=
 have done.</div><div><br></div><div>This works except for the problem of w=
ho had the older version, A or B? and what order are A and B going to be as=
king - cause depending on the application&#39;s architecture this order is =
not guaranteed.=C2=A0</div><div><br></div><div>To solve this the autoloader=
 can tell the engine it is safe to mount the file on root using an array re=
turn of [path, true] and mount on the whatchamacallit&#39;s=C2=A0namespace =
if [path, false]. So</div><div><br></div><div>A asks for D. Autoloader retu=
rns [path, false]. Engine maps to \A\D and monkey types=C2=A0D as=C2=A0need=
ed.</div><div>B asks for D. Autoloader returns [path, true]. Engine maps to=
 \D=C2=A0</div><div><br></div><div>Non whatchamacallit=C2=A0code at namespa=
ce C asks for D. It will get the same version B is using and the autoloader=
 shouldn&#39;t be queried unless C makes this ask before B.=C2=A0</div><div=
><br></div><div>When C asks the autoloader gets (string RequestedSymbol, nu=
ll) so it can either do the require itself or return a string, either will =
work (and it has to be this way for backwards compat).</div><div>When B ask=
s the autoloader gets ( Requested, &#39;B&#39; ) and it should return [path=
, true]</div><div><br></div><div><br></div><div>I hope the above is followa=
ble. It&#39;s more of a morning brainstorm than a spec.</div><div><br></div=
></div>

--000000000000ec8268063591bb16--