Move Core/Events into XcVm\Core\Events and its sub-trees: \Contract
(StoppableEventInterface), \Auth, \Module, \Settings, \Stream (the event
classes), plus root EventDispatcher, ListenerProvider, ListensTo, AbstractEvent.
- Namespace 14 files across 6 namespaces; cross-namespace refs imported via use
(AbstractEvent/EventDispatcher → Contract\StoppableEventInterface; Stream events
→ root AbstractEvent). Built-in \Attribute (ListensTo) and ioncube \XC_VM
(PackageInstalledEvent) qualified.
- Rewrite 'use ListensTo;' → FQCN; add use to referrers across src/ and tests/;
fix leading-backslash refs (\EventDispatcher, \ListensTo, \PackageInstalledEvent
from the Module commit) to their FQCNs.
- Tests: add real top-level use imports to ModuleLoaderBootTest (EventDispatcher)
and ListensToAttributeTest (ListensTo) — the use-inserter skipped/mis-placed them
due to a namespace() method and a heredoc fixture already containing the FQCN.
- phpstan-baseline.neon regenerated (292→292).
Completes Core/Container + Core/Events. Verified: php -l clean; PHPStan no errors;
PHPUnit 295/295; EventDispatcher resolves and AbstractEvent implements
XcVm\Core\Events\Contract\StoppableEventInterface.
Move Core/Module into XcVm\Core\Module (BaseModule, ModuleInterface,
MigratableInterface, ModuleLoader, ModuleManager, NavbarRegistry, NavbarItem,
CoreNavbarProvider) and Core/Module/Contract into XcVm\Core\Module\Contract
(the 6 provider interfaces). Completes the Core hub layer.
- Namespace 14 files (8 root + 6 Contract). Root files import the contracts via
'use XcVm\Core\Module\Contract\...'; NavbarProviderInterface imports the
root NavbarRegistry. Qualify still-global deps with leading backslash
(\ServiceContainer, \CommandRegistry, \ModuleState, \ServerEnvironment,
\EventDispatcher, \ListensTo, the Module exceptions, \ZipArchive,
\InvalidArgumentException, \RuntimeException) — Container/Events/Enum/Exception
migrate later. Migrated deps (Router, StreamPipeline, ...) keep their use.
- Rewrite the modules' 'use BaseModule/NavbarRegistry/NavbarItem;' → FQCN; add
'use XcVm\Core\Module\...;' to other referrers across src/ and tests/.
- Fix pre-existing leading-backslash refs to the FQCN.
- Tests: qualify the module fixtures' generated 'use ModuleInterface;' /
'use BaseModule;' / 'use NavbarRegistry;' and the registerRoutes type hint to
FQCN; add real top-level use imports to the fixture-builder tests; update
InterfaceContractTest registerNavbar param-type to the FQCN. Repaired
use-inserter mis-placements in the two tests that declare a namespace() method.
- Public/index.php: class_exists('ModuleLoader') → class_exists(ModuleLoader::class).
- phpstan-baseline.neon regenerated (292→292; no new/unknown-class errors).
Verified: php -l clean; PHPStan no errors; PHPUnit 295/295; the 4 real modules
load and resolve as XcVm\Core\Module\ModuleInterface; leading-backslash
re-sweep across all migrated classes is clean.
Move Core/Http into XcVm\Core\Http (ApiClient, CurlClient, RequestManager,
Request, Response, Router) and Core/Http/Pipeline into XcVm\Core\Http\Pipeline
(StreamContext, StreamMiddlewareInterface, StreamPipeline). RequestGuard.php is
procedural (global functions) and stays global.
- Namespace the 9 classes; qualify still-global deps with leading backslash
(\ServerRepository in ApiClient; \Authorization, \ServiceContainer,
\AdminHelpers in Router) and built-in \Throwable; same-namespace siblings
unqualified.
- Add 'use XcVm\Core\Http\...;' to referencing files — RequestManager 128,
Router 19, ApiClient 15, Request 11, Response 6, CurlClient 5, plus Pipeline —
across src/ and tests/.
- Rewrite the modules' 'use Router;' → 'use XcVm\Core\Http\Router;' (plex,
watch, tmdb).
- Fix pre-existing leading-backslash global refs (\Router etc.) to the FQCN.
- Tests: fully-qualify the Router type hint in generated module fixtures
(registerRoutes(\XcVm\Core\Http\Router ...)) and update the
InterfaceContractTest param-type expectation to the FQCN. Also repaired two
fixtures where the use-inserter mis-placed a 'use' (files declare a method
literally named namespace(), which the tokenizer reports as T_NAMESPACE).
- phpstan-baseline.neon regenerated (292→292; class names in frozen messages
gained the namespace, no new/unknown-class errors).
Verified: php -l clean; PHPStan no errors; PHPUnit 295/295; Http classes resolve
via Composer; leading-backslash re-sweep across migrated classes is clean.
ServerController and ServerViewController called \SettingsManager::getAll() with a
leading backslash (global namespace), which broke after SettingsManager moved to
XcVm\Core\Config — the files' 'use' import does not cover a leading-\ reference.
PHPStan does not report src/Public and PHPUnit does not exercise these controllers,
so this was a latent runtime fatal on the admin server pages.
Drop the leading backslash so the existing use import resolves it. Full re-sweep
confirms no leading-backslash references to any migrated class remain in src/ or
tests/.
Move Core/Database into XcVm\Core\Database (DatabaseHandler, Database,
MigrationRunner, QueryHelper). First of the Core hub sub-layers.
- Namespace the 4 classes; DatabaseHandler extends Database (same namespace);
built-ins/ioncube qualified (\PDO, \PDOException, \Exception, \Throwable,
\XC_VM); Database keeps its 'use XcVm\Core\Logging\FileLogger;'.
- Add 'use XcVm\Core\Database\...;' to referencing files (DatabaseHandler 51,
Database 64, QueryHelper 29, MigrationRunner 3) + 2 test files (PHPStan does not
analyse tests/, so PHPUnit is the gate there).
- Rewrite pre-existing leading-backslash global refs (\DatabaseHandler etc., e.g.
in @param docblocks of ResellerApiDispatcher/ResellerTableRenderer) to the full
FQCN \XcVm\Core\Database\... — a 'use' import does not cover a leading-\
reference. Done with a lookbehind so FQCN continuations and use-lines are intact.
- phpstan-baseline.neon regenerated (292→292; pre-existing Database/migration_logic
findings re-anchored after class names in messages gained the namespace).
Verified: php -l clean; PHPStan no errors; PHPUnit 295/295.
Split the 7-class Core/Parsing/XmlStringStreamer.php (bundled prewk/xml-string-
streamer) per PSR-4 and namespace all into XcVm\Core\Parsing:
- XmlStringStreamer stays in XmlStringStreamer.php (class only).
- ParserInterface, StreamInterface, StringWalker, UniqueNode, File, Stdin each
extracted to their own file.
- Built-in \Exception qualified (new \Exception + @throws \Exception); internal
cross-references (implements ParserInterface/StreamInterface, extends File,
new File/StringWalker/UniqueNode, parser/stream type hints) resolve within the
shared namespace.
- 'use XcVm\Core\Parsing\XmlStringStreamer;' added to the 2 referrers
(EpgCronJob, EPG); the sub-classes are only used internally by the factory.
- phpstan-baseline.neon regenerated (293→292; pre-existing XmlStringStreamer
findings re-anchored to the new files, no new/unknown-class errors).
This completes the Core leaf layer: Logging, Storage, Config (all classes),
Parsing are namespaced. Procedural files (AppConfig/Binaries/Paths/ErrorCodes/
ErrorHandler) remain global by design; vendored M3uParser/PhpM3u8 untouched.
Verified: php -l clean (7 files); PHPStan no errors; PHPUnit 295/295; all 7
classes resolve via Composer with cross-namespace implements/extends intact.
Move the last two Core/Config classes into XcVm\Core\Config. SettingsManager
has the largest fan-out of the whole migration (referenced by ~224 files).
- Namespace SettingsManager (self-contained singleton, no class deps) and
SettingsRepository (\FileCache:: qualified).
- Add 'use XcVm\Core\Config\SettingsManager;' to 224 referencing files and
'use ...\SettingsRepository;' to 12 — call sites (SettingsManager::get(), etc.)
unchanged. Done with a token-based inserter (after namespace/declare/<?php,
idempotent, same-namespace files skipped).
- ToolsCommand::processRecaptcha: drop dead class_exists('SettingsManager') +
method_exists guard (always autoloadable now) → call SettingsManager::clearCache()
directly. This was the only string-literal class reference.
Core/Config is now fully namespaced (ConfigReader, DomainResolver, SettingsManager,
SettingsRepository); the procedural constant files (AppConfig/Binaries/Paths)
remain global by design.
Verified: php -l clean (226 files); PHPStan no errors (baseline unchanged — it is
line-independent so the added use-lines don't disturb it); PHPUnit 295/295; all
Config FQCNs resolve via Composer; sample Public referrers lint-clean.
Move ConfigReader and DomainResolver into XcVm\Core\Config (Composer PSR-4).
SettingsManager/SettingsRepository stay global for now (migrated together later
due to SettingsManager's large fan-out).
- Add namespace to both classes.
- Qualify still-global / ioncube refs: \XC_VM:: in ConfigReader; \CacheReader::,
\ConnectionTracker:: in DomainResolver.
- Add 'use XcVm\Core\Config\...;' to the 15 referencing files (bootstrap, CLI
commands/cron, LegacyInitializer, ModuleManager, stream + player controllers,
player views, PlaylistGenerator, ...) — call sites unchanged.
- ModuleManager::isLoadBalancer: string class_exists('ConfigReader') →
class_exists(ConfigReader::class) (the literal would now always be false).
Verified: php -l clean; PHPStan no errors; PHPUnit 295/295.
Split the two-class Core/Storage/DropboxClient.php per PSR-4 and namespace both
into XcVm\Core\Storage:
- DropboxClient stays in DropboxClient.php (namespaced).
- DropboxException extracted to its own DropboxException.php (extends \Exception).
- Built-ins qualified in DropboxClient (\Exception catch, \CurlHandle docblocks).
- BackupService gets 'use XcVm\Core\Storage\DropboxClient;' (call sites unchanged).
- phpstan-baseline.neon regenerated (294→293; pre-existing DropboxClient findings
re-anchored after the line shift, no new/unknown-class errors).
Verified: php -l clean; PHPStan no errors; PHPUnit 295/295.
Rewrite ModuleLoader::registerModuleAutoloader() from a lossy short-name + glob
lookup into a true per-module PSR-4 resolver: the module's base namespace
(XcVm\Module\{Name}) maps onto its directory, and the namespace remainder
becomes the sub-path.
XcVm\Module\Watch\WatchModule → {modulePath}/WatchModule.php
XcVm\Module\Watch\Service\WatchService → {modulePath}/Service/WatchService.php
- Only classes under the module's own namespace are claimed; everything else
(global legacy classes, other modules, core) falls through untouched. This
removes the short-name glob, so two modules — or two sub-namespaces in one
module — can declare same-named classes without colliding.
- load() now derives the base namespace from the resolved FQCN and registers the
autoloader after class resolution (reordered, still before the main require).
- Marketplace slug dirs unaffected (real $modulePath is used); encrypted-file
handling preserved (require_once + zend_compile_file decrypt hook).
- resolveClassName()/load() already targeted XcVm\Module\{Pascal}\{Pascal}Module
(done in earlier work) — left as is.
console.php FQCN discovery is intentionally NOT changed here: the Cli layer is
still global (CommandInterface, *Command, *CronJob), so switching discovery to
\XcVm\Cli\... would break it. Per the plan it switches atomically with the Cli
layer namespacing (phases 3..N).
New test tests/Unit/ModuleLoaderPsr4ResolverTest.php: sub-namespace resolution,
same-short-name no-collision, foreign-namespace fall-through.
Verified: php -l clean; PHPUnit 295/295 (+3); PHPStan no errors; all 4 real
modules (plex/watch/tmdb/ministra) load and their *Module FQCNs resolve.
Introduce a committed Composer PSR-4 autoloader without changing class
resolution behavior, as the foundation for the incremental PSR-4 migration.
- src/composer.json: PSR-4 (XcVm\ -> ./, M3uParser\, Chrisyue\PhpM3u8\),
platform php 8.1.33 (deploy runtime), optimize-autoloader/classmap-authoritative
false (live path resolution, no class-map cache). autoload.files left empty:
global functions are still loaded by existing require glue; moving them is
deferred until that glue is removed.
- src/vendor/ + src/composer.lock: committed (deploy path has no Composer);
generated with 'composer update' from src/. Regenerate with dump-autoload.
- src/bootstrap.php, tests/bootstrap.php: require vendor/autoload.php first,
then the legacy autoload.php.
- src/autoload.php: drop the igbinary disk cache (enableFileCache/saveCache/
shutdown handler/root-chown + bottom call); register at the END of the SPL
queue (prepend=false) so Composer wins for XcVm\* and only still-global
classes fall through to the in-memory scanner.
- Makefile: add vendor to LB_DIRS so load-balancer archives ship the loader.
- phpstan.dist.neon: exclude src/vendor/* from analysis.
- .gitignore: document that src/vendor/ is intentionally tracked.
- ci.yml: add composer-audit job (no-op until real require deps exist).
Verified: php -l clean; Composer first / XC_Autoloader last in the SPL stack;
tmp/cache/autoload_map no longer written; PHPUnit 292/292; PHPStan no errors.
Plan reviewed by a multi-agent pass (technical-auditor, solution-architect,
devops-lead, security-architect, qa-lead). Captures the phased approach,
blockers (LB archive leak, vendor audit), per-phase test gates and rollback
constraints. Source of truth for the migration.
Adds a Static Analysis section: how to run PHPStan, that CI fails only on new
issues (committed baseline), not to grow the baseline to hide real problems,
how to regenerate it, and the clear-result-cache caveat after stub/PHPDoc edits.
- .github/workflows/ci.yml: new `phpstan` job (PHP 8.3, no Composer) running
`make phpstan` on every push/PR.
- phpstan.dist.neon: include phpstan-baseline.neon so the gate is green on the
~446 pre-existing (mostly false-positive/cosmetic) findings and fails only on
NEW issues. Shrink the baseline over time via `make phpstan-baseline`.
The TMDB entity get($item) returns `empty($item) ? $this->_data : $this->_data[$item]`
— i.e. the whole array OR a single (scalar) item — but was annotated `@return
array`. That made PHPStan treat `$entity->get('id')` / `get('title')` as array,
producing false positives across the codebase: cast.string (TmdbCron, WatchItem),
argument.type (parseTitle/getMovie/getTVShow with array), and `.`-concatenation
"between string and array" errors. Corrected to `@return mixed` on get() in all
10 entity/config classes. No behaviour change; 19 false positives cleared, none
introduced.
PHP class names are case-insensitive, so the module's `TmdbService`
(search/getDetails/createClient) and the domain `TMDbService`
(getMovie/getSeries/addCategories) were the same identifier. getDetails() for a
series calls TMDbService::getSeriesTrailer(), which loaded the second file and
triggered a fatal "Cannot redeclare class" — series detail lookups crashed.
Renamed the module class to `TmdbApiService` (file, class, the two
TmdbController calls, the DI registration in TmdbModule, and doc refs). Also
cast TMDB ids to int at the getMovie/getTVShow/getSeason call sites.
- DatabaseHandler fetchAll/fetchAllKeyed/fetchOne/fetchValue/fetchColumn/
update/delete documented `@param ...$params` but didn't declare the variadic
in the signature (they read it via func_get_args). Declared `...$params` /
`...$whereParams` so the @param is valid and callers get variadic checking.
No behaviour change (func_get_args still captures everything).
- DropboxClient GetLink/GetCopyRef: the by-ref $expires out-param is a unix
timestamp (int / int|false), not string|null — corrected the @param types.
- ConnectionTracker::getCapacity: `$rSettings['split_by'] == 'guar_band';` was a
discarded comparison (==) where an assignment (=) was intended — the proxy
maxclients→guar_band override never happened.
- Thread::__construct: initialised $process (typed resource|null) to int 0;
set it to null to match the property type (and its own default).
In buildProfile() the GPU path (gpu_device != 0) wrapped its scale/deint
builder in `if (!software_decoding) {} else { ... }` with an EMPTY hardware
branch. Consequences:
- GPU + hardware decoding: scale/deint filters were never built at all.
- GPU + software decoding: ran, but the inner `if (!software_decoding)`
selectors (the `[0:v]...[bg];[bg][1:v]` complex-filter variants) were dead,
so only the simple software variants were ever emitted.
The CPU path (gpu_device == 0) has no such wrapper and selects hardware vs
software filter variants correctly via the same inner check. Removed the
erroneous wrapper so the GPU path mirrors it: the inner software_decoding
checks are now live and GPU+hardware-decode streams get their deint/scale.
BEHAVIOUR CHANGE for GPU transcoding (hardware decode now emits filters that
were previously dropped) — verify on a GPU hardware-decode stream before prod.
listModules() returns installed_version/source/previous_version (added to each
entry in the loop) but its @return shape omitted them, so consumers like
ModuleLicensesCronJob — `($m['source'] ?? '') === 'platform'` — were flagged as
always-false and the platform-module filter looked dead. Documented the keys.
- EPG::parse: `strtotime(...) + ($rOffset*60)` coerced a false (invalid date)
to 0 before the `=== false` check, so invalid EPG timestamps were never
skipped — they silently became epoch+offset. Validate the raw strtotime
results first, then apply the offset.
- phpstan.dist.neon: declare the 129 runtime constants as dynamicConstantNames.
PHPStan executes the bootstrap, so define('HOST', (string) mt_rand()) bound a
literal value and comparisons like `HOST !== 'xc_vm'` read as always-true.
Marking them dynamic makes PHPStan use the type, not the sampled value.
$rUser was used but never defined in massEdit() — and has been since the
initial import (the legacy API::massEditUsers had the same undefined var).
At runtime $rUser is null, so `$rUser == $rArray['owner_id']` is `null ==
owner_id`, which (owner_id is always intval) is true only when owner_id === 0.
Replaced with the equivalent, intent-clear `$rArray['owner_id'] == 0`: when a
bulk owner change resolves to 0 (no owner selected), skip changing owner_id.
Behaviour is identical to the prior accidental semantics, minus the bug.
- StreamsCronJob: $rBitrate/$rCompatible/$rResolution/$rAudioCodec/$rVideoCodec
were only set inside `if ($rFFProbeOutput)` (and a nested codecs check) but
consumed by the UPDATE query that runs whenever the .analyse file exists —
undefined vars (nulls/warnings) when probing fails or returns no codecs.
Initialise them to null before the conditional.
- phpstan.dist.neon: exclude src/modules/*/views/* from analysis. These are
templates included into a controller's scope; their variables are injected by
the caller, so standalone analysis flags every one as undefined (~60 false
positives). Symbols are still indexed.
- EnigmaService::getByUserId: returned '' (string) from an array-typed getter
on the not-found path — return array() instead (type-correct, falsy-safe).
- UserRepository::getParent: walks the permission tree and returns the resolved
parent *id* (int), not a user row — corrected @return array|null → int.
- DropboxClient::copyRef: apiCall() 2nd arg is $params (array) for every other
caller, but here passed 'GET' — would set $params='GET' then write
$params['cursor'] to a string offset. Dropped the bogus arg (endpoint takes
no params).
- Request::cleanGlobals: chr('0') passed a string to chr(); intent is the NUL
byte chr(0) (same as the "\x0" strip on the next line).
- PlaylistGenerator: json_decode() on a possibly-null category_id — cast to
(string) to avoid the PHP 8.1 null deprecation.
- EpgService::getStreamEpg/getStreamsEpg: $rStartDate/$rFinishDate are compared
against item timestamps and callers pass time(); corrected @param
string|null → int|null.
- ServerService::changePort: body does intval($rType) and callers pass int
codes; corrected @param string → int.
- ResellerApiDispatcher: $rResponse['isp'] is only set when the request has an
'isp' param, but was dereferenced unconditionally — guard with !empty().
- PlaylistGenerator: $rTypeKey is used as an array (foreach/in_array/implode)
but documented @param string|null — corrected to string[]|null (a string
value would have crashed the foreach).
- RedisCache::has(): `exists() > 0` is invalid against the phpredis stub union
(Redis|bool|int); return (bool) cast — same semantics, type-safe.
- DropboxClient: removed unreachable `return null;` after `return $res;`.
- constants stub: use mt_rand()-based exprs so PHPStan infers GENERAL types,
not literal 0/'' — fixes false division-by-zero (PACKET_SIZE) and
foreach-over-false (str_split with len 0). Load stub via bootstrapFiles so
result-cache invalidates on change.
- return contracts: explicit returns where a path fell through to null and
violated the declared type:
- StreamRepository::getById/getWatchFolder, GroupService::getById,
getStream() → return false (declared array|false).
- ServerRepository::getPublicURL → return '' when server missing (array→string).
- MagService::resetSTB → return query() result (declared bool).
- StreamUtils::getPlaylistSegments → explicit return null.
- NetworkUtils::stopDownload → @return null corrected to @return void.
- PlexController: getPlexToken() called with 5 args but accepts 4 — dropped
the dead 5th argument.
- DropboxClient::getMetaFromHeaders: array_shift() on an array_filter()
expression (not a variable, by-ref error) — assign to a var first.
- WatchdogCommand: wrap numeric-string subtractions (nginx/proc-stat values)
in floatval()/intval().
Adds tests/Support/TestDb.php — a Database-compatible wrapper over
sqlite::memory: injected via setDb() — and StreamConfigRepositoryTest as a
worked example (SELECT/list/keyed/DELETE-cascade/not-found). 286 -> 292 tests.
Line (LineRepository/LineService/PackageService) and Epg (EPG/EpgService):
DI, process/massEdit/massDelete, signals, EPG parse/lookup. No behavior change.
Divarion-D