PHP

Westyx Nexus PHP SDK

PHP 8.3+ SDK for Westyx Nexus. Synchronous blocking API. Uses Guzzle 7 for HTTP.

v0.10.0

Version alignment - released at v0.10.0 in lockstep with the Westyx Nexus SDK suite.

aws_iam WIF provider (AWS IAM Caller Identity) - authenticates non-EKS AWS compute (ECS/Fargate, Lambda, plain EC2) that has IAM credentials but no OIDC token. The SDK SigV4-signs an STS GetCallerIdentity request (never sent to AWS) and posts it to /v1/auth/token-exchange; Nexus replays it against a pinned STS endpoint to prove your IAM role. The signed X-Nexus-Server-ID is your service's own base-URL host - a captured request is valid for that one service only, and there is nothing to configure. Requires the optional aws/aws-sdk-php package (composer suggest); selecting aws_iam without it throws an actionable error. See Workload-identity.
Security hardening - the base URL must be https:// (loopback excepted); expired WIF sessions refresh transparently on every request path and fail closed (a WIF-only client never falls back to an empty API key); the GCP metadata read and the token-exchange read are size-bounded; auto-detection stats the AWS/Azure token files instead of trusting a bare env var; a non-positive expires_in is clamped.
WIF test suite - per-provider sources, auto-detect precedence, the aws_iam payload + SigV4 signature, https enforcement, and fail-closed refresh.

WIF GCP fix - the gcp provider now fetches a real Google-signed OIDC identity token from the GCE metadata server (it previously read GOOGLE_APPLICATION_CREDENTIALS, a key file that is not a JWT and was rejected by the token exchange). Auto-detection was aligned with the real token sources: AWS_WEB_IDENTITY_TOKEN_FILE, a GCE metadata probe for gcp, and AZURE_FEDERATED_TOKEN_FILE.

Docs fix - corrected the example service base URL from the non-existent https://<slug>.api.westyx.dev to the correct https://<slug>.westyx.dev (the deployed host format, consistent with the other SDKs). No API or behavior change.

OpenFeature provider (westyx/nexus-openfeature) - new sub-package implementing the OpenFeature PHP SDK Provider interface. See OpenFeature for details.

Requires PHP 8.3+ - PHP 8.1 and 8.2 are EOL; minimum bumped to 8.3 (active LTS through 2026).
Security improvements - exception messages contain only HTTP status codes; file-type secret temp paths are fully hashed.
Reliable streaming - connectStream() correctly handles quarantine responses, rate-limit delays, and the full SSE event whitelist including flag.toggled.
CI improvements - tests run on every merge request and main push; publish is restricted to main-branch tags.

Initial PHP SDK release
Read API: getConfig, getSecret, getFlag, getAllConfigs, getAllFlags
File-type secrets: getSecretFilePath (written to temp dir, cleaned up on destruction)
Write API: setSecret, deleteSecret, deleteSecretVersion (secret key only)
SSE live updates: connectStream() for long-running CLI/daemon processes
Workload Identity Federation: kubernetes, aws, gcp, azure auto-detection
A/B testing: evaluateAb
ETag/304 caching, 402 billing halt, 429 quarantine handling