Let extensions and projects register services through DI attributes in attributeServicesDirectories

[ondrejmirtes]

Implements the design from the issue discussion (following the constraints laid out there, as an implementation to compare with #6269):

attributeServicesDirectories:
	- src

• New top-level section (not a parameter), handled by a schema-only container extension; entries are absolutized relative to the declaring config file by NeonAdapter — also in ContainerFactory's pre-pass, which turned out to need no second config pass (NeonCachedFileReader caches raw decodes only).
• Discovery via Composer's static autoload data + native runtime reflection — the PSR-4 path contract and vendor/composer/autoload_classmap.php; no file is ever parsed. A cheap content prefilter ('#[' + case-insensitive phpstan, 100% recall) keeps classes without PHPStan attributes from being autoloaded. A file that suggests a DI attribute but yields no autoloadable class is an explicit error, not a fallback.
• Public allowlist: AutowiredService, NonAutowiredService, RegisteredRule, RegisteredCollector, GenerateFactory, and AutowiredParameter on constructor parameters — now @api, enforced by the new ApiAttributeRule (fires for every attribute position, reports non-@api PHPStan attributes outside PHPStan code). #[ContainerExtension], #[ExtensionInterface], #[AutowiredExtensions] and the other internal attributes are explicit discovery errors, so getInterfaceTagMapping() stays process-static.
• Validation against Composer metadata: each directory must be covered by a psr-4 or classmap rule of the owning package (installed.php install paths) — vendor packages count only autoload (Composer never installs a dependency's autoload-dev), the root project also counts autoload-dev unless Composer ran with --no-dev (dedicated error); psr-0/files-only coverage errors too. On PHP < 8.0 a non-empty section is a clean configuration error.
• Container cache key: directories of regularly installed vendor packages contribute their package's version@reference token — a warm run reads nothing under them; project-own directories and path repositories contribute per-file content hashes (same mechanism as config files). A changed package owning a configured directory invalidates the whole result cache (its rules can affect every file). Editing a discovered class rebuilds the container.
• Reusable registration seam: AttributeServicesRegistrar + AttributeTargetsProvider serve both vendor/attributes.php and the discovered targets; discovery is lazy, so a container-cache hit never autoloads a third-party class. The stub-validator derivative container re-runs discovery through ContainerFactory::create() (regression-tested).
• neon2attributes command: deterministically converts services:/rules: entries into the attributes, declares the edited directories in the section, reports everything it keeps in NEON with the reason (setup, literal arguments, underivable or partial tags, multi-registration, vendor classes, unusual constructor layouts), and verifies itself: it compiles the original and the converted configuration in fresh subprocesses and requires an identical tagged-services fingerprint (tag → classes → multiplicities), rolling everything back otherwise.

Real-world check on calebdw/phpstan-laravel: neon2attributes extension.neon converts 133 entries and keeps 22 with reasons — the plan matches the hand-made conversion in calebdw/phpstan-laravel#10 exactly (118 #[AutowiredService] + 14 autoTag: false + 4 rules; 3 later kept because their constructors put parameters on one line) — and the fingerprint verification confirms identical tagged services.

Compatibility note for extension authors: a migrated extension can only require PHPStan versions that know the section — older PHPStan fails with Found section 'attributeServicesDirectories'.

Closes phpstan/phpstan#15114

🤖 Generated with Claude Code

https://claude.ai/code/session_01Vw4RxhEifXdnTPw57hG3Vw