{
    "name": "cubic/worx-demo-portal-api",
    "description": "WORX Solutions Demo Portal — REST API over Dataverse",
    "type": "project",
    "license": "proprietary",
    "require": {
        "php": ">=8.2",
        "ext-curl": "*",
        "ext-json": "*",
        "ext-openssl": "*",
        "ext-mbstring": "*",
        "slim/slim": "^4.12",
        "slim/psr7": "^1.6",
        "php-di/php-di": "^7.0",
        "firebase/php-jwt": "^7.0",
        "predis/predis": "^2.2",
        "monolog/monolog": "^3.5",
        "vlucas/phpdotenv": "^5.6"
    },
    "require-dev": {
        "friendsofphp/php-cs-fixer": "^3.49",
        "phpstan/phpstan": "^2.2",
        "phpunit/phpunit": "^10.5"
    },
    "autoload": {
        "psr-4": {
            "Worx\\Portal\\": "src/"
        }
    },
    "autoload-dev": {
        "psr-4": {
            "Worx\\Portal\\Tests\\": "tests/"
        }
    },
    "scripts": {
        "test": "phpunit",
        "stan": "phpstan analyse --memory-limit=512M",
        "fix": "php-cs-fixer fix",
        "lint": "php-cs-fixer fix --dry-run --diff",
        "check": ["@stan", "@test"],
        "serve": "php -S localhost:8080 -t public"
    },
    "config": {
        "sort-packages": true,
        "optimize-autoloader": true
    },
    "comments": {
        "predis": "Pure-PHP Redis client, so the API runs where ext-redis is absent (this dev box, notably). BRD A15 assumes Redis on the VM; CacheFactory falls back to APCu and then to a filesystem cache, each with a documented limitation.",
        "firebase/php-jwt": "v7: 6.10-6.11.1 are blocked by advisory GHSA-2x45-7fc3-mxwq, and BRD SEC-9 says the build fails on high/critical rather than suppressing. Chosen over lcobucci/jwt for its first-class JWK::parseKeySet, which is exactly the Entra JWKS shape BRD 6.3 step 2 requires. Signature verification only — every other claim check in that pipeline is ours, because a library that validates 'a token' is not the same as one that validates THIS token."
    }
}