All Components
The framework is popphp/popphp plus a component for each job it does, every one of them its own
Composer package. composer create-project popphp/framework installs all of them, so if you followed
Installation everything on this page is already in your vendor/
directory and needs no registration step. If you took the core on its own, each entry here is one
composer require popphp/<name> away.
Every component is an independent repository with its own version number, its own test suite and its own
README. They depend on one another through Composer and nothing else — no component reaches back into
Pop\Application, which is why any of them works on its own inside a project that is not a Pop
application at all.
The groupings below are editorial, not structural. Nothing in the code knows about them; they exist so you can find the package you want without reading every name on the list.
Each entry links to two things, and they answer different questions. The guide is a page on this site that provides a more in depth tutorial on how to use the component. The README in the component's repository is the complete API surface: every class, every method, every option. Reach for the guide when you are learning the component and the README when you know what you want and need the signature.
Core & Application#
The packages an application is built out of, plus the tooling you use while building it. popphp and
its direct requirements — pop-config, pop-console, pop-http and pop-utils — are the only
components a core-only install pulls in, which makes this band the closest thing the framework has to
a mandatory set. The rest are here because they are about the application itself rather than about
anything it does: scaffolding it, generating code for it and watching it run.
popphp — the framework core: application, router, dispatch, modules, services, events and
middleware. Pop\Application is the object your front controller constructs and calls run() on, and
everything else in the core is something it coordinates. v7 absorbed the Popcorn package, so HTTP-verb
routing, custom verbs and real 404-versus-405 handling are native rather than an add-on. It also gained
PSR-11 for the service locator, PSR-14 for events and PSR-15 for middleware, so a container, listener or
handler written against those interfaces drops in.
Applications & Bootstrap · Routing · README
pop-kettle — the CLI companion that scaffolds, migrates and manages your application. The kettle
script in your project root runs pop:init to write the skeleton, db:* and migrate:* for database
management and migrations, queue:* for job queues, create:* to quickly create stub code files and
web:* for the development server and asset building. Commands you write yourself in the application
namespace are autoloaded alongside the built-in ones.
pop-console — the output and input layer for console applications: a response buffer, ANSI colors,
headers and footers, alerts, tables, progress bars, and prompts including a multi-select. It's what
kettle renders through, and what your own commands render through when you build a CLI application on
the same Pop\Application object an HTTP application uses.
Building Console Applications · README
pop-utils — the shared helper layer every other component leans on: Str and Arr for string and
array work, Collection for the results of a multi-row query, ArrayObject, CallableObject, DateTime,
Num, Uuid, File and the type-coercion helpers. Pop\Utils\AbstractModel also lives here in v7,
having moved out of the core.
Utilities & Helpers · Models · README
pop-config — configuration objects loaded from PHP, JSON, INI, XML or YAML. A Config reads as an
array, an object or a dot path, refuses writes unless you ask for them, and merges another array in with
either side winning. Pop\Application accepts one directly in place of a bare array.
Config Objects · Configuration · README
pop-code — generate PHP source with generator objects, or reflect existing source back into them.
v7 caught the generator up with modern PHP: attributes, enums, readonly properties, constructor
promotion, variadic and by-reference parameters, typed constants and intersection types. It's the
engine behind Kettle's create:* commands.
pop-debug — a debugger that collects timing, memory, query, request and exception data during a request and stores it for later, through storage adapters for files and databases, a PSR-3 logger, or both. v7 added NDJSON storage and automatic redaction of sensitive request data.
HTTP, API & Security#
Everything between the network and your application code: parsing what arrives, sending what leaves, and
deciding who is allowed to ask. Authentication and authorization are two components, not one — pop-auth
establishes that a caller is who they claim to be, pop-acl decides what that caller may then do, and
neither knows about the other.
pop-http — both halves of HTTP. The server half is the Request and Response a controller works
with, including uploads and content negotiation; the client half is a full outbound client with curl,
stream and mock handlers, a middleware pipeline, promises and curl-command conversion. v7 made it
PSR-7, PSR-17 and PSR-18 compliant alongside its native API, and added a Mock handler that answers
requests from a canned script, which is what makes code that calls other services testable without a
network.
Requests & Responses · HTTP Client · README
pop-session — session management with namespaces, so one part of an application cannot read another's keys by accident, plus values that expire after a number of requests or a number of seconds. v7 turned on secure cookie flags and strict mode by default.
pop-auth — authentication, and in v7 authentication only. Two adapters ship: File for a flat
password file, and Jwt for verifying a signed token's signature and claims. Database-backed
authentication moved to pop-db as Record\Auth, the HTTP adapter was replaced by using pop-http
directly, and the LDAP adapter was removed.
pop-acl — role-based access control: roles with inheritance, resources, per-role and per-resource
permissions, assertions that add a runtime condition to a rule, and policies that delegate the decision
to a method on your own class. pop-form and pop-nav both consume it.
pop-crypt — password hashing with bcrypt and Argon2, two-way encryption over OpenSSL and
Sodium, and HMAC, RSA and EC signature verification. v7 added XChaCha20-Poly1305 and HKDF key
separation, and the signature verifier is what pop-auth's JWT adapter checks tokens with.
pop-cookie — cookie management with the same shape as the session API, including the SameSite, Secure and HttpOnly flags and array access over the request's cookies. It's a direct requirement of the core, so it's present in every install.
pop-mime — MIME message parsing and building: headers with their parameters, single and multipart
bodies, base64 and quoted-printable encoding, and multipart form data. v7 moved pop-mail's message and
part classes here, so this is now where a mail message is actually assembled.
Data#
Getting data in, checking it, storing it and getting it back out. pop-db is the large one and has six
guide pages of its own; the rest of this band is deliberately small, single-purpose packages that a
project uses one at a time. pop-validator and pop-filter are usually reached through pop-form
rather than directly, but both work on a bare value with no form in sight.
pop-db — the database layer: five adapters (MySQL, PostgreSQL, SQLite, SQL Server and PDO), a
portable SQL builder, a schema builder, migrations, and the Record active-record class with
relationships and eager loading. v7 turned the shorthand predicate syntax into a small query language,
added lifecycle hooks and mass-assignment protection, and absorbed pop-auth's table adapter as
Record\Auth. It has no dependency on the framework core, and the core has no dependency on it — an
application that never touches a database never loads any of this.
Connecting & Adapters · Records & the ORM · README
pop-audit — application auditing: record what changed on a model, who changed it and when, and send it to a database table or a remote HTTP endpoint. It reads a record's dirty attributes, so the audit trail is the diff rather than a full copy of the row.
pop-csv — read and write CSV from PHP arrays, with control over delimiters, enclosures, escapes, which columns to include, and how nested values collapse into a cell. v7 added a generator row reader for files too large to hold in memory, and formula-injection escaping for output opened in a spreadsheet.
pop-validator — validate a value against a rule object: types, ranges, lengths, counts, dates,
regular expressions, credit cards, email addresses and set membership, each a class you construct with
its bound and call. pop-form uses it for field validation, and it works standalone on any value.
pop-filter — filter and sanitize values on the way in or the way out, by naming a callable and its
arguments. pop-form, pop-http and pop-view all route their filtering through it rather than
carrying their own.
pop-parser — new in v7. Two native parsers with no third-party dependencies:
Pop\Parser\Address\AddressParser breaks a free-form US or Canadian street address into street number,
name, route type, direction, unit, city, state, postal code and country, detecting PO boxes; and
Pop\Parser\Name\NameParser breaks a personal name into salutation, first, middle and last name,
surname prefix, initials, nickname and suffix, including the Last, First form. Both construct with or
without data, parse, and read back through get*() methods, toArray() or a string cast.
Name & Address Parsing · README
Views & Front-End#
Turning data into what a browser receives. pop-view is a robust component to cleanly and securely
organize the data that needs to be rendered to a browser. pop-dom provides a way to manage
DOM-based elements like those rendered by pop-form and pop-nav, all components that assist in
quickly configuring and rendering common HTML components.
pop-view — view rendering over two template kinds: a plain .phtml file with PHP in it, and a
stream template with its own small language for iteration, conditionals, includes and block inheritance.
v7 can compile stream templates to PHP so every render after the first is an include, and fixed
multi-block inheritance, which in v6 resolved only a block named header. A controller does not have to
use it: rendering a template is a call you make, not a step the framework takes on your behalf.
pop-form — build a form from a config array, render it, and validate and filter what comes back,
with errors attached to the fields that produced them. It integrates with pop-validator for rules,
pop-filter for sanitizing and pop-acl for hiding fields a role may not see. v7 rebuilt CSRF
protection as per-field tokens compared in constant time, and added ARIA attributes.
pop-nav — render a navigation tree from a config array, with per-branch attributes, an active-state class driven by the current URL, and ACL filtering so a branch a role cannot reach never renders.
pop-paginator — turn a total row count and a per-page size into either a range of page links or a jump-to-page form, with bookends and ellipsis handling for sets too large to list every page of.
pop-dom — build, render and parse XML and HTML as a tree of Child nodes, each with attributes,
child nodes and a node value. It's what pop-form and pop-nav render through. v7 escapes
attribute values, which is a security fix and a behavior change for anything that was escaping them
itself.
pop-css — generate a stylesheet from selector and declaration objects, parse an existing one back
into them, and minify either. Color values go through pop-color, so a declaration can take a color in
any space the color component understands.
pop-i18n — translate application strings from XML or JSON language files, with positional parameters and alternate phrasings under one source string. Files are per language and region, and the component escapes what it renders.
Infrastructure#
The parts of an application that keep running when nobody is looking at a browser. Each of these is an API over a choice of backends, and that API provides portability should the backend change — a queue moves from files to Redis, a cache from APCu to Memcached, a logger from a file to stdout, and the code that runs it stays the same.
pop-queue — job queues, workers and scheduled tasks over four adapters: files, a database table,
Redis and Amazon SQS, plus a memory adapter for tests. v7 rewrote the adapter contract around leases —
reserve, release, bury — so a worker that dies mid-job no longer loses it, and added a dead-letter
store, a worker registry with heartbeats, and daemon loops with signal handling. Kettle's queue:*
commands drive all of it from the project root, so running a worker does not need an application script
of your own.
Queues & Scheduled Tasks · README
pop-cache — one caching API over adapters for files, Redis, Memcached, APCu, a database table, the
session, memory and a null sink. v7 added PSR-6 and PSR-16 surfaces alongside the native one, plus
remember() with stampede protection, tag-based invalidation, atomic counters and an injectable clock
for deterministic TTL tests.
pop-log — logging through writers for files, syslog, a stream such as stdout, a database table, mail and an HTTP endpoint. v7 made it a real PSR-3 logger: string levels, placeholder interpolation, context processors, pluggable formatters and JSON Lines output.
pop-mail — compose and send mail over SMTP, sendmail, or the hosted APIs for Mailgun, SendGrid,
Office 365, Amazon SES and Google; read it back over IMAP or the Office 365 and Google clients. It also
queues messages to a directory and sends them later. Message assembly moved to pop-mime in v7.
pop-storage — one file API over local disk, AWS S3 and Azure Blob, so the calling code does not change when the backend does. v7 added streaming put and fetch for large objects, presigned URLs and path-traversal rejection.
pop-dir — directory traversal and file listing: recursive or flat, absolute or relative paths, filtered by search string, with the entries available by array access. v7 collapsed it to a single filesystem walk.
Media & Documents#
Producing files a person opens rather than a browser renders. Often overlooked until it's needed,
the functionality provided by components like pop-image and pop-pdf plays a large part in the visual
impact of an application beyond the browser. It's this functionality that's been in Pop since day one
and has always been treated as a first-class citizen.
pop-pdf — build a PDF from pages, text, images and vector paths; import an existing one and modify
it; add annotations and form fields; merge documents; render HTML; and extract text. The v7 extractor is
a native Pop\Pdf\Extract engine — cross-reference and object streams, the standard filters, CMap and
CID font decoding — replacing the third-party parser v6 depended on. It's the largest single addition
in the release, and it's what makes reading, merging and OCR-routing a PDF possible without shelling out
to an external tool.
pop-image — resize, crop, scale, convert, adjust, filter and draw on images through either GD or Imagick, behind one API. Effects, layers, drawing and text each have their own object reached from the image.
pop-color — color values and conversion across twelve spaces: RGB, hex, CMYK, grayscale, HSL, HSB,
HSV, HWB, Lab, Lch, Oklab and Oklch. Seven of those are new in v7, along with CSS Color 4 parsing and
rendering and hex with alpha. pop-css and pop-pdf both use it.