🧱 Layered Architecture

The three layers of Composer Skills are not "decorative" — each layer has a clear dependency direction: Application Layer → SDK Layer → Base Layer, and lower layers never depend back on upper layers.

🧱 Base Layer

The base layer is the foundation of the entire project, comprising four packages with no mutual business coupling.

📦 pkg/domain

A pure data-model package defining structs such as Package, Advisory, Statistics, and Version. It does not depend on any other package in the project and serves as a "neutral zone" for sharing types across the SDK layer.

🔍 pkg/detector

Detects whether Composer is already installed across operating systems, supporting multiple installation methods on Windows / macOS / Linux (brew, apt, phar, executable). Dependencies: no internal dependencies, only the standard library.

⚙️ pkg/installer

Automatically installs Composer when it is missing, and can also install PHP alongside it. It intelligently detects the operating system to choose brew, apt, or a direct phar download.

• Exposed interface: installer.NewInstaller(config), inst.Install()
• Dependencies: pkg/detector (detect first, then decide to install), pkg/composerutils (filesystem/HTTP download), pkg/composerutils/mock (testing)

🛠️ pkg/composerutils

A shared utility set covering filesystem operations (fs.go), HTTP downloads (http.go), the Mock executor (mock/mock.go), and test helpers (test_utils.go). It is the "Swiss Army knife" reused by the installer.

🔌 SDK Layer

The SDK layer wraps two categories of external systems into typed Go APIs.

⌨️ pkg/composer (CLI Wrapper)

Wraps the local composer binary, providing 234 methods organized into 20 categories.

• Exposed interface: composer.New(opts), comp.SetWorkingDir(), comp.AuditWithJSON(), etc.
• Dependencies: pkg/detector (detect at startup), pkg/installer (auto-install missing Composer when AutoInstall: true)
• Testing: injects fake command output via SetupMockOutput without actually running composer

🌐 pkg/client + pkg/repository (Packagist API)

A pure-Go HTTP client that requires no PHP.

• pkg/client: 20 methods (search, statistics, security advisories), depends on pkg/domain for return types
• pkg/repository: the repository operations layer, also depends on pkg/domain

🖥️ Application Layer

💻 cmd/composer-skills

A Cobra-based CLI tool with 50+ subcommands. It depends on three packages — pkg/composer, pkg/client, and pkg/domain — exposing SDK capabilities to the terminal.

📚 docs

The VitePress documentation site and progressive disclosure guides (docs/skills/).

Dependency Direction at a Glance

Dependency arrows point strictly downward: Application Layer → SDK Layer → Base Layer.

Key Constraint

The base layer never imports the SDK layer or the application layer in reverse. This rule guarantees that the base layer can be reused by any upper layer and tested independently.

Detailed Import Relationships

For the complete set of inter-package imports, see Package Dependencies.