Difference between require and install vs create-project in composer

Question 1

I don't get how the create-project works in composer. Lets take Laravel as example.

I can install this PHP framework with the following command:

composer create-project laravel/laravel --prefer-dist

This command installs the framework for me leaving me with a few folder in the root of my dir:

app
bootstrap
public
vendor

Plus some files.

But when I simply use the following composer command:

composer require laravel/laravel --prefer-dist
composer install

Then this only installs the vendor folder. No other files and folders are downloaded by composer.

How come? What is so different? How does composer know what other files to get when I use the create-project laravel/laravel command and why do I only get the vendor folder when I do require laravel/laravel?

Question 2

require will add a dependency to the composer.json file and load it into the vendor directory as you have correctly noticed.

create-project on the other hand will clone the dependency, i.e. use the dependency as a template for a new project. Take a look at the repository behind laravel/laravel: https://github.com/laravel/laravel

Question 3

It's not anything to do with Yii directly.

Composer allows you to install dependencies globally or per-project (the default).

https://getcomposer.org/doc/03-cli.md#global

This is merely a helper to manage a project stored in a central location that can hold CLI tools or Composer plugins that you want to have available everywhere.

You might want to install something like phpunit or phpcs globally (so it's available for every project) whereas installing a library or framework that you need for your project should be a per-project installation.

Question 4

Indeed, Composer will not recursively look at composer.json files in the file system. It needs to see the composer.json files in the repository. The way it usually works is that a package has a git or svn URL somewhere. Composer will fetch, for instance, git://<host>/<package>/composer.json directly from the repository to figure out that package's dependencies before it's even installed to calculate the overall dependencies.

In your case, you are defining a package inline in your own composer.json file. This is used instead of a composer.json file in the dependency. This means Composer takes the "package": { ... } to be the canonical composer.json file for that package, it will not look into the code itself; especially not after unpacking it. It treats the Zip file as if it had no composer.json file of its own.

Define the dependencies in the "package": { ... } or host the code in a version control system from which Composer can fetch the composer.json file.

Question 5

First of all: Do not confuse new require("...") (which invokes require as a constructor) with new (require("...")) (which invokes the return value of the require call as a constructor). You are doing the first one.

require was not intended to be invoked as a constructor with new. That's not Node-idiomatic, and generally weird. You shouldn't do it, since it reduces the readbility of your code. A future reader might easily mistake it for new (require("...")) (i.e., calling new on a constructor that is being returned by require), since normal Node style does not use new with require.

Now, let's talk about actual side effects.

new causes a function to run its [[Construct]] internal method, which takes the following actions:

invoke the function with a this set to a newly-created object whose prototype is set to the function's prototype property
Return a result:
- if the function returns an object, return the result of the function
- if the function returns anything else, return the newly-created this object

The return value new require will be the same as require for all modules whose exports value is non-primitive (which is true of virtually any module; they typically export a plain object or a function, which is also a kind of object). In the rare case that your module does export a primitive, though, then new will deny you access to that value.

The only other possible difference between require(...) and new require(...) is that the new variant is supplied with a different this value. However, require appears to ignore its this value totally. (Note that Module.prototype.require -- a different function from normal require -- does use its this value, but that's only used when you require submodules from a module, using module.require(...).)

Question 6

The require-dev packages are packages that aren't necessary for your project to work and shouldn't be included in the production version of your project.

Typically, these are packages such as phpunit/phpunit that you would only use during development.

Difference between require and install vs create-project in composer

Answers

php,composer-php