LaraFly is the PHP edition of the Firefly Framework — Spring Boot's cohesion, native to Laravel 13. It layers dependency injection with stereotypes, conditional auto-configuration, hexagonal ports & adapters, CQRS, event-driven architecture, first-party security including both halves of OAuth2, and a project CLI directly onto Laravel's own runtime. Nothing is forked or wrapped: a LaraFly app is, in every respect a Laravel developer would recognize, still a Laravel app — it just boots like a Spring Boot one.
The whole framework is one monorepo of small, independently-installable Composer packages, wired together by a single zero-reflection boot pipeline: a component scan compiles to a cached manifest once, and every request after that runs against plain PHP arrays — no runtime reflection on the hot path.
composer create-project firefly/skeleton my-app
cd my-app
php artisan firefly:cache # compile the zero-reflection boot manifests
php artisan serveSee Installation for requirements and manual setup, and Getting Started for a walkthrough of the generated app.
- Attribute-driven DI & auto-configuration —
#[Service],#[Repository],#[Configuration]classes are discovered by a compiled scan; install a capability package and its defaults wire themselves up, your own beans always win. - Hexagonal by construction — every subsystem exposes a port and one or more adapters, with architectural direction enforced by Deptrac, not convention alone.
- Declarative transactions & CQRS —
#[Transactional]demarcates boundaries at scan time; one generated proxy per bean runs the whole advice chain, security before transaction (Adviceorder 100 against 1000), so a refusal is thrown before a transaction is ever opened. ACommandBus/QueryBusmediator dispatches commands and queries, with domain events bridged onto the event-transport bus after commit. - Event-driven, with real brokers — an in-memory default plus RabbitMQ, Postgres LISTEN/NOTIFY, and Kafka
adapters behind one
EventPublisherport. - Secure by default — a session-persisted
SecurityContext, form login on the framework's own page, HTTP Basic, remember-me, logout, deny-by-defaultHttpSecurityURL rules, and method security (#[PreAuthorize],#[PostAuthorize],#[PreFilter],#[PostFilter]) enforced on any stereotyped bean through that same shared interceptor chain. - Both halves of OAuth2 — sign in with an external provider (OIDC login
with provider presets, discovery, PKCE, id-token validation, RP-initiated logout, client credentials and
Http::oauth2Client()), or be the provider (an authorization server with registered clients,/oauth2/authorizewith PKCE and a consent page,/oauth2/tokenwith three grants, introspection, revocation,/userinfo, JWKS and both.well-knowndocuments). - Traced and logged like a service, not a script — a
Tracer/Spanport with an OpenTelemetry adapter, a W3Ctraceparentcontinued at the server filter and carried on through theHttpclient, both CQRS buses and the in-memory and queue event buses, and structured logging injson,ecsorlogstashcarrying the same ids. - Production-ready out of the box — an Actuator surface (health/info/beans) and a Prometheus/Micrometer-style metrics core, both secured by the same config as everything else, plus a server-rendered admin dashboard over them with a drawn bean graph, and an opt-in, off-by-default data browser over your own repositories, with filtering, full CRUD, relations you can walk and a drawn entity map.
- An API document that cannot drift —
firefly/openapigenerates OpenAPI 3.1 from the same compiled manifests the dispatcher and the validator read, and serves the official Swagger UI from your own origin — no annotation dialect, no npm, no CDN. - A first-party test kit — a boot harness, recording doubles for every port, and
#[WebSlice]/#[DataSlice]test slices, dogfooded across the framework's own suites — which include a Pest 4 + Playwright suite driving real Chromium over the skeleton's own pages; that one is the framework's, and Contributing has what it covers and how to run it.
Every capability above ships as a package you install on its own. The module index lays all 32 guides out by concern, with a line on each saying what it is for, and the same grouping is the site's Modules tab.
| Group | Guides |
|---|---|
| Foundation | Error Handling · Dependency Injection · Configuration · Application Context · Auto-Configuration · Validation |
| Web & API | Web Layer · Web Filters · OpenAPI |
| Resilience & Scheduling | Resilience · Scheduling |
| Data & Domain | Domain (DDD) · Data & Repositories · Relational Data · Transactions |
| Eventing & Messaging | EDA · EDA Brokers · Messaging |
| CQRS | Command/Query |
| Security | Security · OAuth2 Client · OAuth2 Authorization Server |
| Operations | Actuator · Observability · Tracing · Logging · Admin Dashboard · Bean Graph · Data Browser |
| Testing | Testing · Integration Testing |
| Tooling | Installer |
Want to see it all working together? The
Lumen sample is a
runnable digital-wallet & ledger vertical slice exercising #[Transactional], CQRS, domain events over EDA,
method security, and a REST layer with RFC-7807 problem-details. The guided, book-style LaraFly by Example
book — 15 chapters plus appendices, bilingual (English + Spanish), building this exact sample — is available
in book/.
- CLI commands: CLI Reference
- Releases & versioning: Versioning · Publishing
- Contributing to the monorepo: Contributing
- Every module guide, grouped: Modules
Apache-2.0 © Firefly Software Solutions Inc.