Every feature. Deep dive.
Nineteen capabilities. One composer install. Attribute routing, compiled DI, authentication, validation, caching, events, queues, mail, telemetry, OpenAPI, CLI — everything an app needs, nothing it doesn't.
HTTP & Routing
Attribute Routing
Define routes where your handlers live.
#[Route('/api/users', name: 'users')]
final class UserController
{
#[Get('/{id:\\d+}', name: 'show', tags: ['Users'])]
public function show(int $id): ResponseInterface { }
}
Security Middleware
OWASP headers, CORS, CSRF, rate limiting, trusted proxy — all PSR-15, all enabled by default. Not "secure once you install five packages."
// Default stack: SecurityHeaders → TrustedProxy
// → RequestId → CORS → RateLimit
// → Session → CSRF → Auth → Router
Auth & Security
Authentication Suite
The entire authentication lifecycle. In one package. JWT, OAuth2, TOTP 2FA, API keys, RBAC, policies, Argon2id — not as separate add-ons.
$result = $authService->login([
'email' => 'user@example.com',
'password' => 'secret',
]);
if ($result->requires2FA) {
return json_response(['challenge' => $result->challengeToken]);
}
$tokens = $result->getTokens();
Validation & DTOs
Type-safe requests. Zero boilerplate. Annotate DTO properties with validation attributes. Invalid input never reaches your controller.
final readonly class CreateUserRequest
{
public function __construct(
#[Assert\NotBlank, Assert\Email]
public string $email,
#[Assert\Length(min: 8, max: 64)]
public string $password,
) {}
}
Data Layer
Database & QueryBuilder
PDO, but modern. A connection manager, fluent builder, and entity scanner. No ORM magic, no hydration tax, no Doctrine proxies.
$users = $qb->select(['id', 'name', 'email'])
->from('users')
->where('status', '=', 'active')
->orderBy('created_at', 'DESC')
->limit(10)
->get();
Compiled DI Container
Zero runtime reflection. In production. Autowiring in dev, compiled static PHP array in production. One command flips the switch.
#[Provider(priority: 10, context: 'http')]
#[BootAfter(DatabaseProvider::class)]
final class PaymentProvider extends AbstractServiceProvider
{
public function getDefinitions(): array { ... }
}
Templates & Assets
Template Engine (MLView)
Familiar syntax. Compiled output. No surprises. Directives, layouts, inheritance — compiled to optimized PHP.
@extends('layouts.app')
@section('content')
<h1>{{ $user->name }}</h1>
@foreach($posts as $post)
<article>{{ $post->title }}</article>
@endforeach
@endsection
File Management
Uploads, storage, and image processing. Unified. Local, S3, GCS through one interface. Garbage collection included.
$path = $files->store($upload, 'avatars', disk: 's3');
$thumb = $images->process($path, [
'resize' => [150, 150],
'format' => 'webp',
]);
return $files->url($path);
Background & Events
Events (PSR-14)
Attribute-discovered listeners, priority ordering, wildcard subscriptions, queueable listeners.
#[Listener(event: UserRegistered::class, priority: 10)]
final class SendWelcomeEmail
{
public function __invoke(UserRegistered $event): void
{
$this->mail->send($event->email, 'welcome');
}
}
Queue System
Redis, database, or array drivers. Retry with exponential backoff, timeouts, batching, middleware.
$this->queue->push(new SendEmailJob($user->id, 'welcome'));
$this->queue->later(3600, new SendEmailJob($user->id, 'tips'));
# php ml queue:work --tries=3 --timeout=60
Operations & Observability
Telemetry & Observability
Prometheus metrics, distributed tracing (Jaeger/Tempo), structured logs — all wired by default.
$span = $this->tracer->startSpan('order.place');
$this->metrics->counter('orders_placed_total')->inc();
$this->metrics->histogram('order_amount_usd')->observe($total);
OpenAPI v3
Routes + DTOs + return types = your API spec. No hand-maintained YAML, no doc rot.
#[Get('/', name: 'users.index',
summary: 'List all users',
tags: ['Users', 'API'],
)]
public function index(ListUsersQuery $query): UserCollection { }
CLI Framework
17+ scaffolders, DB migrations, queue workers, schedule runner, interactive REPL — one binary.
php ml make:controller User
php ml make:entity User
php ml migrate
php ml queue:work
php ml tinker
I18n
File + database loaders, ICU-style plurals, nested keys, locale detection middleware.
echo $t->trans('messages.greeting', ['name' => 'John']);
// "Hello, John!"
echo $t->choice('messages.items', 5);
// "5 items"
SMTP + API transports, DKIM signing, template-backed mailables, queueable delivery.
$mailer->to($user->email)->send(new WelcomeMail($user));
$mailer->to($user->email)->queue(new WelcomeMail($user));
Cache (PSR-16)
Redis, file, Memcached, array. Tagging, locking, stampede protection, multi-store.
$result = $cache->remember('expensive', 3600,
fn() => computeExpensive());
$cache->tags(['products'])->flush();
Ready to start?
Every feature above ships as one composer create-project command.