# Plerino

> Plerino is an open-source PHP framework that compiles routing, services, configuration, event listeners and templates at build time and runs the application as a long-lived worker. It is maintained by PHRAMEA under the MIT licence. It is in active development towards 1.0 and has no stable release yet.

Key facts:
- Requires PHP 8.5.12 or later; every change is checked on PHP 8.5 and PHP 8.6.
- Compile-time first: routes, services, configuration, listeners and templates are resolved once at build time.
- Worker-first: the runtime package ships drivers for FrankenPHP worker mode and PHP-FPM, with worker recycling. Swoole and RoadRunner drivers are planned.
- Typed APIs and explicit contracts; no runtime magic.
- Secure by default: libsodium is the only cryptography provider, secrets are redacted from logs, templates escape output by default.
- Built on standards: PSR-3, PSR-6, PSR-7, PSR-15, PSR-16, PSR-17, PSR-18, PSR-20, ICU MessageFormat, RFC 9457 Problem Details, OpenTelemetry, WebAuthn.
- Packages: 30 Composer packages in one monorepo and 5 planned packages (bastion, bridge, facet, seeker, warden).
- Status: no stable release; public APIs may change before 1.0. No benchmark results have been published. The source repository is not publicly accessible yet. Documentation is being prepared for publication on this site.

## Pages
- [Overview](https://plerino.dev/): Plerino is an open-source PHP framework that compiles routing, services, configuration, listeners and templates at build time and runs as a long-lived worker. Typed APIs, no runtime magic, secure by default.
- [Ecosystem | Plerino packages by area](https://plerino.dev/ecosystem/): Every package of the Plerino framework, grouped by area: foundation, HTTP and runtime, templates, data, background work, realtime, security, communication, application support and observability.
- [Use cases | Where Plerino fits](https://plerino.dev/use-cases/): Where the Plerino PHP framework fits: API backends, SaaS platforms, real-time applications, background jobs and workflows, internal tools, event-driven integrations and security-sensitive environments.
- [Security | Defaults and vulnerability reporting](https://plerino.dev/security/): The security defaults of the Plerino PHP framework and how to report a vulnerability privately, with the OpenPGP key, response targets and safe harbour.

## Languages
- [English](https://plerino.dev/)
- [Türkçe](https://plerino.dev/tr/)
- [Deutsch](https://plerino.dev/de/)
- [Français](https://plerino.dev/fr/)
- [Español](https://plerino.dev/es/)

## Packages
- plerino/contracts: Interfaces, enums and value-object contracts that define the public API surface, with PSR re-exports.
- plerino/kernel: Boot, the build pipeline, discovery, request scopes, the middleware pipeline and the error boundary.
- plerino/container: A compiled service container with singleton, scoped and transient lifetimes declared by attributes.
- plerino/config: Typed configuration classes compiled at build time from environment variables, with secrets kept out of the compiled file.
- plerino/crypto: libsodium wrappers: authenticated encryption, a key ring with rotation, hashing, signing and the Secret value type.
- plerino/clock: A PSR-20 clock, a frozen clock for tests and a Duration type.
- plerino/collection: Typed immutable collections, maps and lazy sequences.
- plerino/money: Exact monetary amounts with ISO 4217 currencies, allocation and formatting.
- plerino/framework: The meta-package that requires the core packages.
- plerino/http: A PSR-7, PSR-15 and PSR-17 implementation with typed input classes, a response factory, Problem Details and security headers.
- plerino/routing: Route attributes, typed parameters, a compiled matcher and URL generation.
- plerino/kinetic: The runtime: FrankenPHP worker and PHP-FPM drivers, worker recycling and health endpoints. Swoole and RoadRunner drivers are planned.
- plerino/http-client: A PSR-18 client with a server-side request forgery guard, redirect control, retries, a pool and fakes.
- plerino/weft: An HTML-native template compiler with components, slots and escaping by default. It also renders mail markup and PDF documents.
- plerino/bridge (planned): An adapter for client-side front ends with server-side rendering.
- plerino/tessera: Entities, repositories, an immutable query builder and migrations for PostgreSQL, MySQL and SQLite, a MongoDB document store and vector search.
- plerino/cache: PSR-6 and PSR-16 caches with file, memory, Redis and Memcached stores, tags, locks and stampede protection.
- plerino/filesystem: Local and S3-compatible storage with validated paths, streams, upload inspection and presigned URLs.
- plerino/seeker (planned): Search drivers and a vector search bridge.
- plerino/flux: Queue drivers for Redis Streams, PostgreSQL and SQS, jobs, batches, durable workflows and a dashboard.
- plerino/scheduler: Scheduled classes compiled at build time, cron expressions, time zones and locks across nodes.
- plerino/events: Typed events with listeners compiled at build time, asynchronous delivery and a transactional outbox.
- plerino/comet: A realtime server over WebSocket and server-sent events with channels, policies, presence, replay and end-to-end encrypted channels.
- plerino/aegis: Sessions, guards, passkeys, TOTP, recovery codes, magic links, OAuth sign-in, API tokens and policies for RBAC, ABAC and ReBAC.
- plerino/bastion (planned): Runtime application protection.
- plerino/warden (planned): Data classification, an audit chain and GDPR tooling.
- plerino/mail: Messages, MIME building, SMTP, SES, Postmark and Resend transports, DKIM, queued delivery and preview.
- plerino/notifications: Notifications over mail, SMS, Telegram, Web Push, Slack and a database inbox, with preferences and queue hand-off.
- plerino/validation: Attribute rules, a validator and translated messages.
- plerino/i18n: ICU MessageFormat, locale negotiation, formatters and the core translations.
- plerino/log: A PSR-3 JSON lines logger with secret redaction and size-based rotation.
- plerino/console: Command attributes, input and output, prompts and tables.
- plerino/cli: The plerino binary: build, serve, routes, container, doctor, secrets, key rotation and generators.
- plerino/facet (planned): Feature flags.
- plerino/lens: OpenTelemetry traces, metrics and logs over OTLP, development panels, a toolbar and a detailed error page.

## Use cases
- API backends: Services that expose JSON over HTTP and need predictable routing, strict input handling and clear error contracts. Packages: http, routing, validation, tessera, aegis, cache, http-client.
- SaaS and multi-service platforms: Products made of several services that share sign-in, localisation, monetary amounts and communication with customers. Packages: aegis, tessera, flux, mail, notifications, money, i18n, config.
- Real-time applications: Live dashboards, collaboration features and status updates that must survive reconnects. Packages: comet, events, aegis.
- Background jobs and workflows: Work that should not run inside a request: deliveries, imports, reports and long-running business processes. Packages: flux, scheduler, events, tessera.
- Internal tools and back offices: Administrative applications where forms, permissions and an audit trail matter more than a heavy front end. Packages: weft, validation, aegis, tessera, filesystem, i18n, console.
- Event-driven integrations: Systems that react to changes and exchange data with other services reliably. Packages: events, flux, http-client, tessera, notifications.
- Regulated and security-sensitive environments: Teams that have to show how authentication, cryptography and logging behave, not only state it. Packages: aegis, crypto, tessera, log, config, lens.

## Security
- [Security page](https://plerino.dev/security/): defaults and private vulnerability reporting
- [security.txt](https://plerino.dev/.well-known/security.txt): how to report a vulnerability privately
- [OpenPGP public key](https://plerino.dev/security.asc): key for security@plerino.dev, fingerprint CE54 B9BD 090A 77C8 76F1 6469 5738 9547 7EB3 C109

## Contact
- General: hello@plerino.dev
- Security: security@plerino.dev
- Press: press@plerino.dev
- Abuse: abuse@plerino.dev