Question 1

responseModel: takes a class-string - is passing user input to it a code injection risk?

Accepted Answer

Yes, and the README flags it as a security issue rather than a style note. A dynamic class-string would let the SDK call an arbitrary fromSystemOne() method, which is type confusion; keep the value a literal in your own code. Anything else in the factory is your responsibility, since only UnexpectedValueException is treated as a validation failure and rewrapped as ResponseValidationError, while other exception types propagate unchanged.

Question 2

What happens on a 429, and can retry behavior change per call?

Accepted Answer

RateLimitError is a distinct class, so you can catch it separately from the ApiError base before logging and backing off. The default is a 10-second timeout per attempt and two retries with exponential backoff on 408, 429, 5xx, connection errors and timeouts; RetryPolicy changes it client-wide and RequestOptions overrides it for a single call. Not documented: whether backoff is jittered, whether Retry-After is honored, or any total per-call budget.

Question 3

Will this work on my older PHP or without ext-curl?

Accepted Answer

Not as shipped. The README states PHP 8.4 or newer with the curl and json extensions, and CI tests 8.4 and 8.5. The default transport is cURL, but you can inject your own Transport for framework integration and tests, which is the documented escape hatch for a different stack. The README does not state which older PHP versions the code is compatible with, or what happens if ext-json is missing on a version that bundles it.

Question 4

How do I model my own response type without losing the raw payload for debugging?

Accepted Answer

Implement ResponseModel and pass the class-string as responseModel:. Your fromSystemOne() factory receives the full SystemOneResponse and pulls out the answers it cares about, returning null for an omitted or unknown answer, and you throw UnexpectedValueException when a required answer is missing. The SDK then hands you a ResponseValidationError that exposes the raw response, so you can log it deliberately rather than by default.

Question 5

Does it drag in a framework or extra dependencies?

Accepted Answer

No. It is strictly typed, passes PHPStan at max level and has zero framework dependencies; the only requirements are PHP 8.4 or newer and the curl and json extensions. The default transport is cURL but it is injectable, so you can swap in a framework client or a test double without changing the call site.

Question 6

How do I list the models my account can use?

Accepted Answer

Call $client->models->list(), the model discovery method the client exposes. The default model is jev-latest, overridable through the defaultModel argument or the TYPESAFE_DEFAULT_MODEL environment variable alongside TYPESAFE_API_KEY and TYPESAFE_BASE_URL.

Question 7

What license is it under, and how do releases track the official SDKs?

Accepted Answer

MIT. Releases follow the same version line as the official JavaScript and Python SDKs, requiring Client::VERSION, the latest changelog entry and the Git tag to match exactly, for example 0.6.0 with tag v0.6.0. CI tests PHP 8.4 and 8.5, and Packagist needs its GitHub integration configured to consume the tag.

TypeSafe SDK Php

About this project

Highlights

Questions about this entry

More Jev resources like this

From the Jev guides

From the Jev community