- How do I install mpociot/human-regex in a Laravel application?
- Install it with composer require mpociot/human-regex. It is MIT licensed and ships no service provider, config file, or facade, so there is nothing to register or publish once Composer finishes. The practical first step is a throwaway branch so you can see exactly what lands in composer.lock and pin the version you actually tested.
- Does human-regex require a service provider or config file in Laravel?
- No. It is a leaf string builder rather than a framework extension, so it touches nothing until a call site invokes it, with no bootstrapping, container binding, or runtime lifecycle participation. Removing it later means editing the classes that import it, not unwinding configuration or cache state. Most teams confine the import to one internal seam such as App\Support\Pattern.
- Can I use human-regex patterns in Laravel validation rules like regex:?
- Yes, in principle. It compiles to a portable PCRE string that preg_match, preg_replace, and Laravel's regex: validation rule can consume. Before relying on it, confirm whether get() emits a fully delimited pattern or an undelimited body, because the regex: rule needs correct delimiters and modifiers to behave as expected.
- Does ->get() return a delimited pattern or just the regex body?
- That is not stated in the README and must be verified against the source before you commit. The distinction matters: a bare body means you add delimiters and the u modifier yourself, while a full pattern may already include them and will break if you wrap it again. Write a contract test that asserts the exact output string for a small representative pattern.
- Does then('foo') escape special characters or insert them raw?
- This is unverified without reading the source, and it is the highest-risk unknown for anything touching user input. If then() interpolates raw, a string containing a dot or a bracket silently changes the pattern's meaning, which is a regex-injection exposure; if it applies preg_quote, literals are safe. Test both a metacharacter-laden string and a plain one, and treat the raw path as untrusted until proven otherwise.
- How do quantifiers like maybe() and oneOrMore() bind after a group?
- The binding rule for maybe(), oneOrMore(), atLeast(), and atMost() following a group is not documented in the overview, so verify it with a test such as start()->capture()->letters()->endCapture()->maybe()->end(). In regex, quantifiers bind to the single preceding token or group, and a fluent API could plausibly choose either behaviour. Pin the behaviour you observe with a unit test so a patch release cannot change it silently.
- What regex features can't human-regex express?
- There are no lookarounds, backreferences, conditionals, named captures, or atomic groups. Some patterns will stay hand-written, and that is an expected outcome rather than a pilot failure. If more than roughly a third of your sampled patterns do not fit, you end up maintaining two regex vocabularies and neither is authoritative.
- Are letters() and digits() ASCII-only, and how is the u modifier handled?
- Unconfirmed. The overview advertises letters() and digits() as common-token helpers but does not state whether they compile to ASCII classes or Unicode-aware ones, nor how the u modifier is applied. If you accept non-ASCII input, test accented letters and non-Latin scripts explicitly and fall back to a hand-written pattern where the helpers fall short.
- Is human-regex safe for production use and resistant to ReDoS?
- The builder changes how a pattern is written, not how PCRE executes it. A chain that reads cleanly can still backtrack catastrophically, so keep input-length guards and ReDoS review for anything reachable from user data. Treat readability as a review aid rather than a safety guarantee, and keep these exclusions in a written guardrail instead of tribal knowledge.
- How do I avoid lock-in given human-regex has a single maintainer?
- Pin the exact version on install and log it in your dependency risk register, since there is one maintainer, a modest star count, and no downstream dependents to act as a canary. Import the package in exactly one class such as App\Support\Pattern and cover that seam with contract tests asserting the compiled strings. If it is abandoned, the replacement cost collapses to editing that single class.