# vendor/ — how this was built (read this before touching dependencies)

This project's `vendor/` folder was **not** generated by `composer install`.
It was assembled by hand, package-by-package, straight from each library's
GitHub repository, because the server this was prepared for has no access to
Packagist (`repo.packagist.org`). Composer itself isn't the problem — every
one of these packages is PHP 7.4-compatible — the issue was only that the
network path to resolve/download from Packagist wasn't available.

## What's in here

`vendor/autoload.php` is a small hand-written PSR-4 autoloader that plays
the same role Composer's generated `vendor/autoload.php` normally does. It
has been tested end-to-end: JWT encode/decode, a real `GuzzleHttp\Client`,
and a full `Ratchet` WebSocket stack (`IoServer` + `HttpServer` + `WsServer`)
bound to a real socket all work through it, and both `public/index.php` and
`public/admin.php` were exercised as real HTTP requests against it.

Packages included (all confirmed PHP 7.4-compatible), pinned to these exact
tagged releases:

| Package | Version | Source |
|---|---|---|
| firebase/php-jwt | v6.10.0 | github.com/firebase/php-jwt |
| guzzlehttp/guzzle | 7.8.1 | github.com/guzzle/guzzle |
| guzzlehttp/promises | 2.0.4 | github.com/guzzle/promises |
| guzzlehttp/psr7 | 2.7.0 | github.com/guzzle/psr7 |
| psr/http-message | 2.0 | github.com/php-fig/http-message |
| psr/http-factory | 1.1.0 | github.com/php-fig/http-factory |
| psr/http-client | 1.0.3 | github.com/php-fig/http-client |
| ralouphie/getallheaders | 3.0.3 | github.com/ralouphie/getallheaders |
| symfony/deprecation-contracts | v2.5.4 | github.com/symfony/deprecation-contracts |
| ratchet/rfc6455 | v0.3.1 | github.com/ratchetphp/RFC6455 |
| cboden/ratchet | v0.4.4 | github.com/ratchetphp/Ratchet |
| react/event-loop | v1.5.0 | github.com/reactphp/event-loop |
| react/socket | v1.15.0 | github.com/reactphp/socket |
| react/stream | v1.4.0 | github.com/reactphp/stream |
| react/promise | v3.2.0 | github.com/reactphp/promise |
| react/dns | v1.13.0 | github.com/reactphp/dns |
| react/cache | v1.2.0 | github.com/reactphp/cache |
| evenement/evenement | v3.0.2 | github.com/igorw/evenement |

One deliberate omission: `cboden/ratchet`'s `composer.json` also lists
`symfony/http-foundation` and `symfony/routing` as requirements, but those
are only used by `Ratchet\App` and `Ratchet\Http\Router` — classes this
project's `ws-server.php` never uses (it builds `IoServer` /
`HttpServer` / `WsServer` directly). Since PHP autoloading only fires when a
class is actually referenced, they were left out to avoid pulling in two
large, version-sensitive dependency trees for code paths that never run.
If you ever add code that uses `Ratchet\App` or `Ratchet\Http\Router`,
you'll need to add those two packages (and their own dependencies) as well.

## If you ever get real Composer/Packagist access

Nothing about this setup is meant to be permanent. If this server (or a
staging box, or your own machine) ever has normal internet access, the
proper fix is to just run Composer for real and let it regenerate
everything:

```bash
rm -rf vendor
composer install --no-dev
```

That will produce Composer's own optimized autoloader and a proper
`composer.lock`, and this file becomes irrelevant. Nothing else in the
project needs to change either way — `public/index.php`, `ws-server.php`,
and everything under `src/` only ever call `require __DIR__ . '/vendor/autoload.php'`
or `.../../vendor/autoload.php'`, so either autoloader (Composer's or this
hand-built one) works as a drop-in replacement for the other.