PHPackages                             velvetcms/core - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Framework](/categories/framework)
4. /
5. velvetcms/core

ActiveLibrary[Framework](/categories/framework)

velvetcms/core
==============

Modular PHP content application framework with file-native page content, events, templates, and more. Foundation for the VelvetCMS platform.

v2.3.0(2mo ago)001Apache-2.0PHPPHP ^8.4CI passing

Since Jan 24Pushed 2mo agoCompare

[ Source](https://github.com/VelvetCMS/core)[ Packagist](https://packagist.org/packages/velvetcms/core)[ RSS](/packages/velvetcms-core/feed)WikiDiscussions main Synced 1mo ago

READMEChangelog (10)Dependencies (23)Versions (19)Used By (0)

VelvetCMS Core
==============

[](#velvetcms-core)

 [![VelvetCMS Logo](https://camo.githubusercontent.com/a46023978cad1396b2c0902e4a58b4a99321589146d31f076b2316843e3ce2d9/68747470733a2f2f76656c766574636d732e636f6d2f6173736574732f696d616765732f6c6f676f2d66756c6c2d7472616e73706172656e742e706e67)](https://camo.githubusercontent.com/a46023978cad1396b2c0902e4a58b4a99321589146d31f076b2316843e3ce2d9/68747470733a2f2f76656c766574636d732e636f6d2f6173736574732f696d616765732f6c6f676f2d66756c6c2d7472616e73706172656e742e706e67)

 [![License](https://camo.githubusercontent.com/b29de0acdfd19013f1f02689b15c933e4a6c145be9efa718288f88ba3280b1c5/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f6c6963656e73652d417061636865253230322e302d626c75652e737667)](LICENSE) [![PHP Version](https://camo.githubusercontent.com/6e44ad49e5307c87d1393389feb52ab61c99956e2e5f8c77177b2501f1d3d47f/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f7068702d253345253344382e342d3838393242462e737667)](https://php.net)

---

Why VelvetCMS Core?
-------------------

[](#why-velvetcms-core)

VelvetCMS Core is a PHP framework for developers who want full-stack capabilities without framework opacity. Explicit architecture, practical defaults, a codebase you can trace end to end.

We call this **Pragmatic Zero Magic**: every service binding, every middleware, every routing decision is visible in code you own - not buried in framework internals.

Core tracks modern PHP aggressively. We target current stable releases early, remove legacy detours when they warp the design, and prefer clear upgrade paths over compatibility baggage.

- **Explicit over Implicit**: Service bindings live in bootstrap code, routes and middleware are declared directly, and the request lifecycle stays readable end to end.
- **Pragmatic Convenience**: Autowiring helps with controllers and commands, but command registration, module loading, and core service wiring remain explicit where hidden resolution would cost clarity.
- **No Facades**: Dependencies arrive through constructors and method signatures, so tests and refactors work against real contracts instead of global static state.
- **Content First**: Page content is file-native, the parser understands frontmatter and block modes, and routing plus caching are tuned for publishing workloads rather than generic CRUD scaffolding.
- **Lean by Design**: The runtime stays small, the dependency graph stays short, and the codebase remains compact enough to inspect without framework archaeology.

---

Features
--------

[](#features)

### Core Architecture

[](#core-architecture)

- **Service Container**: Powerful dependency injection container. Explicit by default, with autowiring available as a pragmatic fallback.
- **Modular System**: Robust plugin architecture with PSR-4 autoloading, dependency resolution, and manifest-based loading for optimal performance.
- **Event Dispatcher**: Comprehensive event system allowing hooks into every part of the application lifecycle.
- **CLI Suite**: Extensive command-line tools for migrations, cache management, scaffolding, serving, diagnostics and more.

### Content & Data

[](#content--data)

- **File-Based Content**: Pages live as `.vlt` or `.md` files. They stay versionable, portable, and inspectable, with an on-disk index for fast lookups and no database requirement for page content.
- **Fluent Query Builder**: Expressive database abstraction layer supporting complex queries, joins, raw expressions, and automatic caching.
- **Schema Builder & Migrations**:
    - **Database Agnostic**: Write schemas once, run on SQLite, MySQL, or PostgreSQL.
    - **Fluent Interface**: Define tables and columns with an expressive syntax (`$table->string('title')->nullable()`).
    - **Migration System**: Version control for your database schema with `up` and `down` methods.
- **Pluggable Markdown Engine**:
    - **Drivers**: Support for `CommonMark` (recommended), `Parsedown`, or simple `HTML` pass-through.
    - **Extensible**: Custom template tags (`{{ }}`, `{!! !!}`) preserved in all drivers.
    - **CommonMark Features**: Tables, Strikethrough, Autolink, Task Lists (via extensions).
- **Velvet Content Blocks**: `.vlt` files with YAML frontmatter and block switches (`@markdown`, `@html`, `@text`).
- **Data Store**: Simple key-value collections with `File`, `Database`, or `Auto` drivers for module data.
- **Smart Caching**: Multi-driver support (`Apcu`, `File`, `Redis`) for caching queries, pages, routes, configuration, templates, and markdown compilation.
- **File Storage**:
    - **Disk System**: Abstraction layer for file operations (write, read, stream).
    - **Drivers**: `Local` driver implemented (S3/Cloud ready interface).
    - **Security**: Built-in path normalization to prevent directory traversal.

### Web & Security

[](#web--security)

- **Robust Router**: Expressive routing engine with support for:
    - GET, POST, PUT, DELETE, PATCH methods
    - Named routes and parameters
    - Optional and wildcard parameters (`{param?}`, `{param*}`)
    - Middleware pipelines and global middleware
- **HTTP Client**:
    - **cURL-backed**: Lightweight outbound HTTP client for integrations, webhooks, and service-to-service calls.
    - **Ergonomic Requests**: GET, POST, PUT, PATCH, DELETE, query helpers, JSON/form/raw bodies, default headers, bearer auth, and basic auth.
    - **Typed Responses**: Status helpers, header access, JSON decoding, retry support, and `throw()` for failed responses.
- **Validation Service**:
    - **Standalone Validator**: reuse validation logic anywhere (CLI, API, Imports).
    - **Rich Rule Set**: `required`, `email`, `url`, `min`, `max`, `regex`, `numeric`, `integer`, `boolean`, `alpha`, `alphanumeric`, `in`, `same`, `different`, `date`, `array`.
    - **Fluent API**: `Validator::make($data, $rules)->validate()`.
    - **Custom Rules**: `app(ValidationExtensionRegistry::class)->extend('slug', fn($value) => ...)` for project-specific validation.
- **View Engine**: Lightweight yet powerful templating system featuring:
    - Blade-like syntax (`{{ }}`, `{!! !!}`)
    - Blade-style comments (`{{-- ... --}}`)
    - Control structures (`@if`, `@foreach`)
    - Layout inheritance (`@extends`, `@section`, `@yield`)
    - Partials and includes (`@include`)
    - Namespace support for modular views
    - Configurable runtime string evaluation guard for `compileString()` / `safe()`
- **Asset Server**: Built-in static asset serving for development and production, handling MIME types and module assets efficiently.
- **Trusted Proxy Support**: Optional forwarded host/scheme/IP handling for reverse-proxy deployments (`http.trusted_proxies`).
- **Response Caching**: ETag-based HTTP caching middleware with `304 Not Modified` support for GET/HEAD responses.
- **Security Suite**: Built-in protection against common vectors.
    - ✅ **XSS Protection** - Auto-escaping template engine
    - ✅ **CSRF Protection** - Token-based validation
    - ✅ **SQL Injection** - Prepared statements by default, with explicit raw-expression escape hatches for advanced clauses
    - ✅ **Session Security** - httponly, secure, samesite flags
    - ✅ **Path Traversal** - Sanitization and realpath checks
- **Rate Limiting**:
    - **Named Limiters**: Pre-configured (`standard`, `api`, `auth`, `strict`) or custom.
    - **Module Support**: Modules register their own limiters via `RateLimiter` service.
    - **Dynamic Limits**: Callbacks for user-aware throttling (e.g., premium users).
    - **Flexible Keys**: Limit by IP, user, route, or custom keys.
    - **Whitelist**: Bypass for trusted IPs.
- **Exception Handling**:
    - **Custom Handler**: Centralized error handling and reporting.
    - **HTTP Exceptions**: Specialized exceptions for 404, 403, 500, etc.
    - **Renderable Exceptions**: Exceptions that can render their own response.
- **Logging**:
    - **PSR-3 Compliant**: Standard `LoggerInterface` with all log levels.
    - **Daily Rotation**: Optional dated log files (`velvet-2026-01-28.log`).
    - **Auto Cleanup**: Configurable `max_files` to prevent disk bloat.

### System & Scheduling

[](#system--scheduling)

- **Job Queue**: Database-backed async job processing with sync and database drivers.
    - **Retry & Deduplication**: Configurable retry attempts, unique job constraints.
    - **Worker Daemon**: `queue:work` command with graceful shutdown, memory limits, and max-job caps.
- **Task Scheduler**: Cron-style task scheduling defined in PHP.
    - **Fluent Frequency**: Define schedules naturally (`->daily()`, `->everyMinute()`).
    - **Command & Callback**: Schedule console commands or PHP closures.
- **Schedule Runner**: CLI `schedule:run` and optional WebCron endpoint (`/system/cron`).
- **Version Registry**: Centralized version management for core and modules.

### Multi-Tenancy

[](#multi-tenancy)

- **Single switch**: Enable/disable in [user/config/tenancy.php](user/config/tenancy.php) with `tenancy.enabled` (default off).
- **Resolvers**:
    - **Host**: Map hostnames or subdomains to tenants (`tenancy.host.map`, optional wildcard subdomains).
    - **Path**: Use a path segment as tenant id (`tenancy.path.segment`).
    - **Callback**: Provide a custom resolver that implements `TenantResolverInterface`.
- **Works with**:
    - Content and views (tenant-scoped roots under `user/tenants//...`)
    - Storage and modules (tenant-scoped roots/artifacts)
    - Cache/session isolation per tenant
    - Database-per-tenant setups when desired
- **Isolation**: Cache prefixing and tenant-scoped storage prevent cross-tenant collisions.
- **Sessions**: Path-based tenancy scopes cookies to the tenant path automatically.
- **CLI**: Set tenant context via `$TENANCY_TENANT` or `--tenant=`; use `--all-tenants` for tenancy-aware orchestration commands.

---

Requirements
------------

[](#requirements)

- **PHP 8.4+** (+ extensions: `pdo`, `mbstring`, `json`, `openssl`)
- **Optional PHP extensions**: `curl` for the HTTP client, `apcu` for APCu cache, `redis` for Redis cache
- **Linux/WSL2**
- Composer
- SQLite, MySQL, or PostgreSQL (optional)

---

Quick Start
-----------

[](#quick-start)

```
# Clone and install
git clone https://github.com/VelvetCMS/core.git
cd core
composer install --no-dev

# Bootstrap
./velvet install

# Start dev server
./velvet serve
```

Visit `http://localhost:8000`

---

Documentation
-------------

[](#documentation)

Full documentation available at **[velvetcms.com/docs](https://velvetcms.com/docs)**

Quick links:

- [Getting Started](https://velvetcms.com/docs/core/latest/guides/getting-started/overview)
- [Install Guide](https://velvetcms.com/docs/core/latest/guides/getting-started/installation)
- [Architecture Overview](https://velvetcms.com/docs/core/latest/guides/architecture/overview)

---

License
-------

[](#license)

VelvetCMS Core is licensed under the **Apache License 2.0**.

See [LICENSE](LICENSE) or [Our licensing page](https://velvetcms.com/license) for the full text.

---

Contributing
------------

[](#contributing)

Contributions welcome! See [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines.

**Security Issues:** Email  (do not open public issues!)

---

Credits
-------

[](#credits)

Built with ❤️ by [Anvyr](https://anvyr.dev).

See [composer.json](composer.json) for dependencies.

###  Health Score

41

—

FairBetter than 87% of packages

Maintenance84

Actively maintained with recent releases

Popularity1

Limited adoption so far

Community7

Small or concentrated contributor base

Maturity61

Established project with proven stability

 Bus Factor1

Top contributor holds 100% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Every ~4 days

Recently: every ~10 days

Total

18

Last Release

82d ago

Major Versions

v1.10.0 → v2.0.02026-03-20

### Community

Maintainers

![](https://avatars.githubusercontent.com/u/235785453?v=4)[VelvetCMS](/maintainers/velvetcms)[@VelvetCMS](https://github.com/VelvetCMS)

---

Top Contributors

[![MichuButAnother](https://avatars.githubusercontent.com/u/48837716?v=4)](https://github.com/MichuButAnother "MichuButAnother (78 commits)")

###  Code Quality

TestsPHPUnit

Static AnalysisPHPStan

Code StylePHP CS Fixer

Type Coverage Yes

### Embed Badge

![Health badge](/badges/velvetcms-core/health.svg)

```
[![Health](https://phpackages.com/badges/velvetcms-core/health.svg)](https://phpackages.com/packages/velvetcms-core)
```

###  Alternatives

[matomo/matomo

Matomo is the leading Free/Libre open analytics platform

21.7k38.9k](/packages/matomo-matomo)[drupal/core

Drupal is an open source content management platform powering millions of websites and applications.

21866.0M1.7k](/packages/drupal-core)[drupal/core-recommended

Locked core dependencies; require this project INSTEAD OF drupal/core.

6942.5M419](/packages/drupal-core-recommended)[shopware/core

Shopware platform is the core for all Shopware ecommerce products.

585.6M572](/packages/shopware-core)[shopware/platform

The Shopware e-commerce core

3.4k1.5M3](/packages/shopware-platform)[kimai/kimai

Kimai - Time Tracking

4.8k9.0k1](/packages/kimai-kimai)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)