composer.json

composer.json is the package manifest that Composer and QUIQQER use to install, update, autoload, and classify a package.

Use Composer metadata for dependency and runtime information. Use package.xml for QUIQQER-facing package metadata such as localized titles, images, support links, and providers.

Required Package Metadata

Every package needs a valid Composer package name, package type, description, license, dependencies, and autoloading.

{
  "name": "vendor/package-name",
  "type": "quiqqer-module",
  "description": "Short package description.",
  "license": "GPL-3.0-or-later",
  "require": {
    "php": "^8.1",
    "quiqqer/core": "^2"
  },
  "autoload": {
    "psr-4": {
      "Vendor\\Package\\": "src/Vendor/Package"
    }
  }
}

Use quiqqer-module for normal extension packages and quiqqer-template for template packages. Do not use older package types for new packages.

Dependencies

Declare direct runtime dependencies in require.

{
  "require": {
    "php": "^8.1",
    "quiqqer/core": "^2",
    "quiqqer/utils": "^2",
    "quiqqer-asset/dexie": "^1.5"
  }
}

Use quiqqer/core as the platform dependency for current packages. Add other QUIQQER packages only when the package uses their public classes, assets, settings, site types, or runtime behavior.

Browser Asset Packages

Use quiqqer-asset/* packages when a package or the platform needs a browser library that is provided through Composer.

These packages wrap selected npm packages as Composer packages and are provided through the QUIQQER asset repository at https://assets.quiqqer.com. This keeps normal installations from requiring direct npm access for shared browser libraries.

QUIQQER installs asset packages below the public asset directory OPT_DIR/bin, for example:

OPT_DIR/bin/quiqqer-asset/requirejs/
OPT_DIR/bin/quiqqer-asset/mustache/

They are then reachable through URL_OPT_DIR, for example from templates, RequireJS configuration, or package browser code.

Direct npm and bower package access is disabled by default in the installation root. A package can still declare its own npm package requirements in composer.json, but the installation must have npm enabled in its package servers. Composer then resolves those packages through the configured asset repository and installs them below OPT_DIR/bin/.

Use suggest for optional integrations:

{
  "suggest": {
    "quiqqer/gallery": "Adds gallery functionality for this package."
  }
}

Autoloading

Current packages use PSR-4 autoloading into src/.

{
  "autoload": {
    "psr-4": {
      "Vendor\\Package\\": "src/Vendor/Package"
    }
  }
}

The namespace must match the PHP classes used in XML files, events, providers, console tools, and setup code.

Developer Scripts

Many packages expose repository checks through Composer scripts. The scripts usually call package-local PHIVE tools from ./tools/.

{
  "scripts": {
    "test": [
      "@dev:lint",
      "@dev:phpunit"
    ],
    "dev:phpunit": "./tools/phpunit",
    "dev:lint": [
      "@dev:lint:phpstan",
      "@dev:lint:style"
    ],
    "dev:lint:phpstan": "./tools/phpstan",
    "dev:lint:style": "./tools/phpcs",
    "dev:lint:style:fix": "./tools/phpcbf"
  }
}

Use the package-local scripts as convenience wrappers. The actual checks are the tools configured in the package repository.

Root Installation Metadata

The installation root has its own composer.json. QUIQQER manages parts of that file for package installation and updates:

• Composer event hooks for package install, update, and remove workflows.
• Installer paths for QUIQQER packages and browser assets.
• Repository entries from configured package servers.
• Stability settings such as minimum-stability and prefer-stable.
• Allowed Composer plugins required by the QUIQQER installation.

Package repositories should not copy root installation metadata into their own composer.json.

Practical Checklist

Before publishing package metadata:

• Use a Composer package name in vendor/name format.
• Use quiqqer-module or quiqqer-template.
• Require php and quiqqer/core with explicit version constraints.
• Declare only direct dependencies in require.
• Use PSR-4 autoloading for PHP classes.
• Add developer scripts only when the referenced tools exist in the package.
• Keep support and user-facing package metadata consistent with package.xml.