Web APIs

Beyond ECMAScript itself, Phasis ships several layered packs of WHATWG / W3C APIs:

Web Platform Pack — pure value types, no I/O: URL, URLSearchParams, URLPattern, TextEncoder, TextDecoder, atob, btoa, structuredClone, performance, DOMException.
Fetch Pack — real HTTP from JavaScript: fetch, Request, Response, Headers, Body, AbortController, AbortSignal, Blob, File, FormData, EventTarget, Event, full WHATWG Streams (ReadableStream, WritableStream, TransformStream, queuing strategies, BYOB), CompressionStream / DecompressionStream (gzip / deflate / deflate-raw via zlib; brotli when the kjdev/php-ext-brotli PECL extension is loaded), navigator, and the HTML-spec self global alias + reportError.
Crypto — crypto.getRandomValues, crypto.randomUUID, and full SubtleCrypto: digest (SHA-1/256/384/512), HMAC, AES-GCM/CBC/CTR, RSA-OAEP/PSS/PKCS1, ECDSA (P-256/384/521), ECDH, HKDF, PBKDF2 — plus JWK import/export. Backed by ext-openssl.
WebSocket — constructor, RFC 6455 frame codec, events. Default transport uses stream_socket_client; replaceable via Engine::setWebSocketTransport() for ReactPHP / Ratchet / mocks in tests.
XMLHttpRequest — layered over the fetch transport, so the same policy hooks and swappable transport apply.
Event loop — setTimeout, setInterval, clearTimeout, clearInterval, queueMicrotask. Plus AsyncContext (Stage 3) propagating values across microtask / timer boundaries.

All packs are on by default. No flag, no setup — typeof fetch returns "function" on a fresh new Engine().

Conformance

The imported Web Platform Tests corpus (tests/Wpt/fixtures/) covers AbortController / AbortSignal, atob / btoa, Blob / File, TextEncoder / TextDecoder, EventTarget / Event, FormData, Headers, performance.now, the full Streams Standard (Readable/Writable/Transform + BYOB + queuing), structuredClone, URL / URLSearchParams, the full crypto / SubtleCrypto surface (digest, HMAC, AES-GCM/CBC/CTR, RSA-OAEP/PSS/PKCS1, ECDSA, ECDH, HKDF, PBKDF2 — including thousands of derive-bits permutations from hkdf and pbkdf2), the WebSocket state machine (constructor URL and subprotocol validation, close-code semantics, send() for strings / ArrayBuffer / typed-array views / Blob, binaryType, bufferedAmount, async close while connecting, event-handler nullability), and a broad slice of Fetch + XMLHttpRequest — responseType state machine, abort/send transitions, CORS-safelisted headers, multipart FormData uploads, XMLHttpRequestUpload + ProgressEvent, Response/Headers init validation, the static Response.json / Response.error constructors, redirect-chain Authorization stripping, URL.createObjectURL blob URLs, body-mixin consumption (text / blob / json / formData / arrayBuffer), Response.clone with structuredClone-d teed streams, and sync XHR network-error throwing. Every imported subtest passes.

To extend further, drop a new *.any.js into tests/Wpt/fixtures/<category>/ — the runner picks it up automatically. The XHR/Fetch suites are driven by tests/Wpt/fetch-server.php (a single-file emulator of the WPT resources/*.py handlers); the WebSocket suite uses an inert in-runner transport that synthesizes open/echo/close, sufficient for the imported fixtures. Run the corpus yourself:

bin/wpt                # everything
bin/wpt --category headers --verbose   # one area, per-subtest output
bin/wpt --json         # machine-readable

fetch() example

const res = await fetch("https://api.example.com/users", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({ name: "alice" }),
});
if (!res.ok) throw new Error(`HTTP ${res.status}`);
const user = await res.json();

That works out of the box. The default transport is PHP ext-curl. Bodies stream through the WHATWG ReadableStream Phasis ships, so for await (const chunk of res.body) also works.

AbortController example

const ctrl = new AbortController();
setTimeout(() => ctrl.abort(), 5000);
try {
  const res = await fetch(slowUrl, { signal: ctrl.signal });
} catch (e) {
  if (e.name === "AbortError") {
    // request was cancelled
  }
}

AbortSignal.timeout(ms) is also implemented (lazy-deadline — checks on aborted read rather than firing an event mid-event-loop; works for fetch transports that poll the signal during transfer).

Embedder controls (PHP side)

Three hooks on the Phasis\Engine class control fetch behavior:

$engine = new Phasis\Engine();

// 1. Swap the HTTP transport. The callable receives a request descriptor
//    and an optional AbortSignal; returns a response descriptor.
$engine->setFetchTransport(function (array $request, $signal) {
    // ... use Guzzle, Symfony HttpClient, your stub, etc.
    return [
        'status' => 200,
        'statusText' => 'OK',
        'headers' => [['content-type', 'application/json']],
        'body' => '{"data":"value"}',
    ];
});

// 2. Pre-flight policy hook — rewrite, deny, or allow.
$engine->setFetchPolicy(function ($request) {
    $url = $request->get('url')->value;
    if (!str_starts_with($url, 'https://')) {
        throw new \RuntimeException('HTTPS only');
    }
    return null;  // allow as-is; return modified Request to rewrite
});

// 3. Cookie jar. Opt-in. Accepts any object with get(url):string and
//    set(url, header):void methods. JsObject or PHP object both work.
$engine->setCookieJar($myJar);

If setFetchTransport() is not called, the default CurlTransport runs. The cookie jar is opt-in — no default jar, no cookies stored unless you provide one.

Streams example

// Producer: ReadableStream that yields numbers 1..5
const rs = new ReadableStream({
  start(controller) {
    for (let i = 1; i <= 5; i++) controller.enqueue(i);
    controller.close();
  },
});

// Consumer: async iteration
for await (const value of rs) {
  console.log(value);  // 1, 2, 3, 4, 5
}

// Pipe through a transform
const ts = new TransformStream({
  transform(chunk, controller) { controller.enqueue(chunk * 2); },
});
const doubled = new ReadableStream({
  start(c) { [1, 2, 3].forEach(n => c.enqueue(n)); c.close(); }
}).pipeThrough(ts);
for await (const v of doubled) console.log(v);  // 2, 4, 6

Full Streams spec: ReadableStream, WritableStream, TransformStream, ReadableStreamDefaultController, ReadableByteStreamController, ReadableStreamDefaultReader, ReadableStreamBYOBReader, ReadableStreamBYOBRequest, WritableStreamDefaultController, WritableStreamDefaultWriter, TransformStreamDefaultController, ByteLengthQueuingStrategy, CountQueuingStrategy, plus pipeTo / pipeThrough / tee.

Event loop

setTimeout, setInterval, clearTimeout, clearInterval, and queueMicrotask are on the global object. Microtasks (Promise handlers, queueMicrotask) drain to completion between every macrotask; timers fire in deadline order via a per-realm queue.

console.log('sync');
queueMicrotask(() => console.log('microtask'));
setTimeout(() => console.log('timer'), 0);
// → sync, microtask, timer

const id = setInterval(() => console.log('tick'), 1000);
// ...later
clearInterval(id);

await new Promise(r => setTimeout(r, 50));   // common "delay" pattern works

Driven by Phasis's Engine::runEventLoop(), which eval() and evalAsModule() call automatically after the synchronous code finishes. The loop is virtual-time by default — setTimeout(cb, 5000) does not sleep PHP; the loop advances its clock to the deadline so the program completes promptly. Real-time embedders drive tickEventLoop() themselves. See API: Event loop for the host-side surface.

What's not shipped

These browser-only or runtime-model APIs are deliberately out of scope — see Known limitations for the full discussion:

window, document, the DOM tree
localStorage, sessionStorage, IndexedDB
Worker, SharedWorker, MessageChannel
Service Workers, Push API, Notifications, BroadcastChannel

Most of these can be polyfilled by the embedder via $engine->setGlobal() if needed.

Growing the WPT corpus

tests/Wpt/upstream/ is a sparse-checkout of web-platform-tests/wpt covering fetch/, streams/, FileAPI/, xhr/formdata/, dom/abort/, dom/events/. To extend coverage: copy any *.any.js file from upstream/<area>/ into tests/Wpt/fixtures/<category>/. The runner picks it up on next run; failures get logged via bin/wpt --verbose.

On this page