phast-sh/phast技術文件

PHP dependencies, at Rust speed.

Phast is an extremely fast dependency manager for PHP, written in Rust. It is a drop-in alternative to Composer: it resolves, downloads, and autoloads your dependencies from Packagist and any Composer-compatible registry, while introducing a clean TOML-first workflow built around phast.toml and phast.lock.

• Blazing-fast installs. Downloads and extraction run fully in parallel, so cold installs are quick and repeat installs are nearly instant.
• Resolution in a blink. A conflict-driven resolver makes short work of huge dependency graphs: real-world projects of 150+ packages resolve in well under a second.
• Composer-compatible. Works with Packagist, Private Packagist, and Satis, reads your existing composer.json, and generates a vendor/autoload.php your application uses exactly as before (including the \Composer\InstalledVersions runtime API).
• TOML-first. A readable phast.toml manifest and a reproducible, merge-friendly phast.lock with stable ordering that keeps diffs small and conflicts rare.
• Scripts runtime. Run named scripts with phast run, and Composer lifecycle events (pre-install-cmd, post-update-cmd, …) fire automatically, with a \Composer\Script\Event shim so your existing handlers just work.
• Errors that actually help. When resolution fails, Phast tells you why: a readable account of the conflicting constraints and which package pulled them in, not a wall of output.
• Workspaces. First-class monorepos with shared constraints, one lock file, and one vendor/ directory: no path-repository wiring.
• Secure by default. Lockfile checksums, a minimum-package-age supply-chain guard, and a built-in audit against Packagist and OSV advisories.

Linux and macOS (prebuilt binary):

curl -fsSL https://raw.githubusercontent.com/phast-sh/phast/main/install.sh | sh

From source (any platform with a Rust toolchain):

git clone https://github.com/phast-sh/phast.git
cd phast
cargo install --locked --path crates/phast

Verify with phast cli version. Update later with phast cli update.

# In an existing Composer project: convert composer.json to phast.toml
$ phast migrate

# Resolve, download, and generate the autoloader
$ phast install

# Add and remove dependencies
$ phast add monolog/monolog:^3.0
$ phast remove monolog/monolog

# Inspect and maintain
$ phast show                  # list installed packages
$ phast why monolog/monolog   # show what requires a package
$ phast outdated              # list packages with newer versions available
$ phast audit                 # scan the lock for security advisories

See phast help for the full command list.

See exactly where the time goes. Add -v and Phast reports every phase, so you can watch how little of it there is:

$ phast install -v
Resolved 151 packages in 0.14s
Locked 151 packages in 0.02s
Installed 151 packages in 2.41s
Autoloaded 151 packages in 0.05s
Finished in 2.62s (151 packages)

When something doesn't fit, you'll know why. A resolution conflict is explained, not dumped: which package wants what, and who pulled it in.

$ phast install
Error: [dependency conflict] Phast could not find compatible versions for your requirements
 ╰─▶ monolog/monolog has incompatible constraints:
       · your project requires monolog/monolog[>=3.0, <4.0]
       · acme/reporting[>=1.0, <2.0] requires monolog/monolog[>=2.0, <3.0]

Monorepos without the wiring. A [workspace] section resolves all members together into a single shared lock file and one vendor/, with constraints from [workspace.dependencies]:

$ phast workspace
acme/platform
  acme/core   1.4.0   packages/core
  acme/api    1.4.0   packages/api   (current)
  acme/web    1.4.0   packages/web

Stay current, safely. phast outdated flags newer releases, phast audit scans the lock against security advisories, and phast cli update upgrades Phast itself in place.

Phast's documentation is available at docs.phast.sh.

The command-line reference is also available locally with phast help.

News and release announcements are posted on the blog at blog.phast.sh.

Phast is in active development. The current release is 0.1.0 Ai-Petri; manifest and lock formats may still change before 1.0. Feedback and issues are very welcome. Pull requests are not accepted yet. Please see CONTRIBUTING.md.

Please report any sensitive issue privately, either through GitHub or [email protected]; see SECURITY.md for the full policy.

Phast is licensed under either of

• Apache License, Version 2.0 (LICENSE-APACHE)
• MIT license (LICENSE-MIT)

at your option.

Third-party attributions are listed in NOTICE and LICENSE-THIRD-PARTY.