PHPackages velvetcms/core - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. [Framework](/categories/framework) 4. / 5. velvetcms/core ActiveLibrary[Framework](/categories/framework) velvetcms/core ============== Modular PHP content application framework with file-native page content, events, templates, and more. Foundation for the VelvetCMS platform. v2.1.0(1mo ago)00Apache-2.0PHPPHP ^8.4CI passing Since Jan 24Pushed 1mo agoCompare [ Source](https://github.com/VelvetCMS/core)[ Packagist](https://packagist.org/packages/velvetcms/core)[ RSS](/packages/velvetcms-core/feed)WikiDiscussions main Synced 1mo ago READMEChangelog (10)Dependencies (16)Versions (17)Used By (0) VelvetCMS Core ============== [](#velvetcms-core) [![VelvetCMS Logo](https://camo.githubusercontent.com/a46023978cad1396b2c0902e4a58b4a99321589146d31f076b2316843e3ce2d9/68747470733a2f2f76656c766574636d732e636f6d2f6173736574732f696d616765732f6c6f676f2d66756c6c2d7472616e73706172656e742e706e67)](https://camo.githubusercontent.com/a46023978cad1396b2c0902e4a58b4a99321589146d31f076b2316843e3ce2d9/68747470733a2f2f76656c766574636d732e636f6d2f6173736574732f696d616765732f6c6f676f2d66756c6c2d7472616e73706172656e742e706e67) [![License](https://camo.githubusercontent.com/b29de0acdfd19013f1f02689b15c933e4a6c145be9efa718288f88ba3280b1c5/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f6c6963656e73652d417061636865253230322e302d626c75652e737667)](LICENSE) [![PHP Version](https://camo.githubusercontent.com/6e44ad49e5307c87d1393389feb52ab61c99956e2e5f8c77177b2501f1d3d47f/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f7068702d253345253344382e342d3838393242462e737667)](https://php.net) --- Why VelvetCMS Core? ------------------- [](#why-velvetcms-core) Most PHP frameworks fall into two camps: heavyweight full-stack solutions with steep learning curves, or minimal routers that leave you rebuilding the same features for every project. VelvetCMS Core sits between those extremes. It is built for developers and teams that want full-stack capabilities without framework opacity: explicit architecture, practical defaults, and a codebase you can reason about quickly. That philosophy is what we call **Pragmatic Zero Magic**. You should be able to trace every part of your application's lifecycle without digging through layers of invisible behavior. Core also deliberately tracks modern PHP aggressively. We target current stable releases early, remove legacy detours when they start warping the design, and prefer clear upgrade paths over dragging old compatibility baggage forward. - **Explicit over Implicit**: Service bindings live in bootstrap code, routes and middleware are declared directly, and the request lifecycle stays readable end to end. - **Pragmatic Convenience**: Autowiring helps with controllers and commands, but command registration, module loading, and core service wiring remain explicit where hidden resolution would cost clarity. - **No Facades**: Dependencies arrive through constructors and method signatures, so tests and refactors work against real contracts instead of global static state. - **Content First**: Page content is file-native, the parser understands frontmatter and block modes, and routing plus caching are tuned for publishing workloads rather than generic CRUD scaffolding. - **Lean by Design**: The runtime stays small, the dependency graph stays short, and the codebase remains compact enough to inspect without framework archaeology. --- Features -------- [](#features) ### Core Architecture [](#core-architecture) - **Service Container**: Powerful dependency injection container. Explicit by default, with autowiring available as a pragmatic fallback. - **Modular System**: Robust plugin architecture with PSR-4 autoloading, dependency resolution, and manifest-based loading for optimal performance. - **Event Dispatcher**: Comprehensive event system allowing hooks into every part of the application lifecycle. - **CLI Suite**: Extensive command-line tools for migrations, cache management, scaffolding, serving, diagnostics and more. ### Content & Data [](#content--data) - **File-Based Content**: Pages live as `.vlt` or `.md` files. They stay versionable, portable, and inspectable, with an on-disk index for fast lookups and no database requirement for page content. - **Fluent Query Builder**: Expressive database abstraction layer supporting complex queries, joins, raw expressions, and automatic caching. - **Schema Builder & Migrations**: - **Database Agnostic**: Write schemas once, run on SQLite, MySQL, or PostgreSQL. - **Fluent Interface**: Define tables and columns with an expressive syntax (`$table->string('title')->nullable()`). - **Migration System**: Version control for your database schema with `up` and `down` methods. - **Pluggable Markdown Engine**: - **Drivers**: Support for `CommonMark` (recommended), `Parsedown`, or simple `HTML` pass-through. - **Extensible**: Custom template tags (`{{ }}`, `{!! !!}`) preserved in all drivers. - **CommonMark Features**: Tables, Strikethrough, Autolink, Task Lists (via extensions). - **Velvet Content Blocks**: `.vlt` files with YAML frontmatter and block switches (`@markdown`, `@html`, `@text`, `@component`). - **Data Store**: Simple key-value collections with `File`, `Database`, or `Auto` drivers for module data. - **Smart Caching**: Multi-driver support (`Apcu`, `File`, `Redis`) for caching queries, pages, routes, configuration, templates, and markdown compilation. - **File Storage**: - **Disk System**: Abstraction layer for file operations (write, read, stream). - **Drivers**: `Local` driver implemented (S3/Cloud ready interface). - **Security**: Built-in path normalization to prevent directory traversal. ### Web & Security [](#web--security) - **Robust Router**: Expressive routing engine with support for: - GET, POST, PUT, DELETE, PATCH methods - Named routes and parameters - Optional and wildcard parameters (`{param?}`, `{param*}`) - Middleware pipelines and global middleware - **Validation Service**: - **Standalone Validator**: reuse validation logic anywhere (CLI, API, Imports). - **Rich Rule Set**: `required`, `email`, `url`, `min`, `max`, `regex`, `numeric`, `integer`, `boolean`, `alpha`, `alphanumeric`, `in`, `same`, `different`, `date`, `array`. - **Fluent API**: `Validator::make($data, $rules)->validate()`. - **Custom Rules**: `Validator::extend('slug', fn($value) => ...)` for project-specific validation. - **View Engine**: Lightweight yet powerful templating system featuring: - Blade-like syntax (`{{ }}`, `{!! !!}`) - Blade-style comments (`{{-- ... --}}`) - Control structures (`@if`, `@foreach`) - Layout inheritance (`@extends`, `@section`, `@yield`) - Partials and includes (`@include`) - Namespace support for modular views - Configurable runtime string evaluation guard for `compileString()` / `safe()` - **Asset Server**: Built-in static asset serving for development and production, handling MIME types and module assets efficiently. - **Trusted Proxy Support**: Optional forwarded host/scheme/IP handling for reverse-proxy deployments (`http.trusted_proxies`). - **Security Suite**: Built-in protection against common vectors. - ✅ **XSS Protection** - Auto-escaping template engine - ✅ **CSRF Protection** - Token-based validation - ✅ **SQL Injection** - Prepared statements by default, with explicit raw-expression escape hatches for advanced clauses - ✅ **Session Security** - httponly, secure, samesite flags - ✅ **Path Traversal** - Sanitization and realpath checks - **Rate Limiting**: - **Named Limiters**: Pre-configured (`standard`, `api`, `auth`, `strict`) or custom. - **Module Support**: Modules register their own limiters via `RateLimiter` service. - **Dynamic Limits**: Callbacks for user-aware throttling (e.g., premium users). - **Flexible Keys**: Limit by IP, user, route, or custom keys. - **Whitelist**: Bypass for trusted IPs. - **Exception Handling**: - **Custom Handler**: Centralized error handling and reporting. - **HTTP Exceptions**: Specialized exceptions for 404, 403, 500, etc. - **Renderable Exceptions**: Exceptions that can render their own response. - **Logging**: - **PSR-3 Compliant**: Standard `LoggerInterface` with all log levels. - **Daily Rotation**: Optional dated log files (`velvet-2026-01-28.log`). - **Auto Cleanup**: Configurable `max_files` to prevent disk bloat. ### System & Scheduling [](#system--scheduling) - **Task Scheduler**: Cron-style task scheduling defined in PHP. - **Fluent Frequency**: Define schedules naturally (`->daily()`, `->everyMinute()`). - **Command & Callback**: Schedule console commands or PHP closures. - **Schedule Runner**: CLI `schedule:run` and optional WebCron endpoint (`/system/cron`). - **Version Registry**: Centralized version management for core and modules. ### Multi-Tenancy [](#multi-tenancy) - **Single switch**: Enable/disable in [user/config/tenancy.php](user/config/tenancy.php) with `tenancy.enabled` (default off). - **Resolvers**: - **Host**: Map hostnames or subdomains to tenants (`tenancy.host.map`, optional wildcard subdomains). - **Path**: Use a path segment as tenant id (`tenancy.path.segment`). - **Callback**: Provide a custom resolver that implements `TenantResolverInterface`. - **Works with**: - Content and views (tenant-scoped roots under `user/tenants//...`) - Storage and modules (tenant-scoped roots/artifacts) - Cache/session isolation per tenant - Database-per-tenant setups when desired - **Isolation**: Cache prefixing and tenant-scoped storage prevent cross-tenant collisions. - **Sessions**: Path-based tenancy scopes cookies to the tenant path automatically. - **CLI**: Set tenant context via `$TENANCY_TENANT` or `--tenant=`; use `--all-tenants` for tenancy-aware orchestration commands. --- Requirements ------------ [](#requirements) - **PHP 8.4+** (+ extensions: `pdo`, `mbstring`, `json`) - **Linux/WSL2** - Composer - SQLite, MySQL, or PostgreSQL (optional) --- Quick Start ----------- [](#quick-start) ``` # Clone and install git clone https://github.com/VelvetCMS/core.git cd core composer install --no-dev # Bootstrap ./velvet install # Start dev server ./velvet serve ``` Visit `http://localhost:8000` --- Documentation ------------- [](#documentation) Full documentation available at **[velvetcms.com/docs](https://velvetcms.com/docs)** Quick links: - [Getting Started](https://velvetcms.com/docs/core/latest/guides/getting-started/overview) - [Install Guide](https://velvetcms.com/docs/core/latest/guides/getting-started/installation) - [Architecture Overview](https://velvetcms.com/docs/core/latest/guides/architecture/overview) --- License ------- [](#license) VelvetCMS Core is licensed under the **Apache License 2.0**. See [LICENSE](LICENSE) or [Our licensing page](https://velvetcms.com/license) for the full text. --- Contributing ------------ [](#contributing) Contributions welcome! See [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines. **Security Issues:** Email (do not open public issues!) --- Credits ------- [](#credits) Built with ❤️ by [Anvyr](https://anvyr.dev). See [composer.json](composer.json) for dependencies. ### Health Score 41 — FairBetter than 89% of packages Maintenance89 Actively maintained with recent releases Popularity0 Limited adoption so far Community6 Small or concentrated contributor base Maturity60 Established project with proven stability Bus Factor1 Top contributor holds 100% of commits — single point of failure How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window. **Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores. **Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement. **Maturity (30%)** — Project age, version count, PHP version support, and release stability. ### Release Activity Cadence Every ~4 days Total 16 Last Release 54d ago Major Versions v1.10.0 → v2.0.02026-03-20 ### Community Maintainers ![](https://www.gravatar.com/avatar/3a35b8822827ba2e91a0b1737d34b62d6149eeaa38b66cf8feada105d658b4e1?d=identicon)[velvetcms](/maintainers/velvetcms) --- Top Contributors [![MichuButAnother](https://avatars.githubusercontent.com/u/48837716?v=4)](https://github.com/MichuButAnother "MichuButAnother (65 commits)") ### Code Quality TestsPHPUnit Static AnalysisPHPStan Code StylePHP CS Fixer Type Coverage Yes ### Embed Badge ![Health badge](/badges/velvetcms-core/health.svg) ``` [![Health](https://phpackages.com/badges/velvetcms-core/health.svg)](https://phpackages.com/packages/velvetcms-core) ``` ### Alternatives [shopware/platform The Shopware e-commerce core 3.3k1.5M3](/packages/shopware-platform)[drupal/core Drupal is an open source content management platform powering millions of websites and applications. 19462.3M1.3k](/packages/drupal-core)[drupal/core-recommended Locked core dependencies; require this project INSTEAD OF drupal/core. 6939.5M343](/packages/drupal-core-recommended)[sulu/sulu Core framework that implements the functionality of the Sulu content management system 1.3k1.3M152](/packages/sulu-sulu)[shopware/core Shopware platform is the core for all Shopware ecommerce products. 595.2M386](/packages/shopware-core)[elgg/elgg Elgg is an award-winning social networking engine, delivering the building blocks that enable businesses, schools, universities and associations to create their own fully-featured social networks and applications. 1.7k15.7k5](/packages/elgg-elgg) PHPackages © 2026 [Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)