Statically enforce dependency boundaries

[nmeri17]

I recently came across Deptrac, and it reminds of Suphle's Suphle\Contracts\Services\Decorators\SelectiveDependencies decorator. On one hand, I want to delegate dependency management to them, since it's dedicated to that purpose. However, there isn't really much incentive to this considering:

• Our decorator handler is a simple one
• A refactor will require low-level access to their library instead of an expected optimization skipping the process altogether

I originally preferred runtime checks since they're more inescapable for defaulting developers (who Suphle is targeting), although obviously, there will be performance tradeoffs during request handling. So, the question here is, is there a better way to balance these objectives? I don't want to allow the possibility of violating the boundaries. Evaluating only decorated classes is easier than scanning the codebase and fishing out culprits, probably in a build step. Perhaps, anyone who chooses to omit dependency enforcement has voided their safety warranty? But this implementation is beyond Suphle's scope and would require a library like Deptrac. Perhaps, there's something bigger at play here -- a special decoration type that causes classes it's applied on to be analyzed at build time then have the decoration removed. Who knows?

A part of me still wants to cater to applications served in traditional index.php fashion -- how can they guarantee those bad eggs didn't slip in between sanitization command was manually run last and when last changes were made?

What are your thoughts?

[nmeri17]

These decorators were refactored into dependency sanitizers with a command that prevents server build if violations are detected