From 91282268235a2d58dec74f21122deed62262b235 Mon Sep 17 00:00:00 2001
From: agis <agis.septiyanto@gmail.com>
Date: Sat, 12 Sep 2026 10:25:55 +0700
Subject: [PATCH 1/2] refactor(encryption): implement L13 Contracts, relocate
 exceptions, drop symfony/security (task 2.9)

Encrypter now `implements Contracts\Encryption\{Encrypter, StringEncrypter}`:
add getAllKeys()/getPreviousKeys() (single-key fork; rotation arrives with the
illuminate/encryption swap), remove setKey() (strict-mode: method-not-found),
and throw Contracts\Encryption\EncryptException instead of \RuntimeException on
encrypt failure. DecryptException canonical location moves to Contracts; the old
Illuminate\Encryption\DecryptException becomes a class_alias bridge so existing
catch sites keep matching until the swap. New StringEncrypter contract mirrors
v13. Container resolves both encryption contracts to 'encrypter'. Fork callsites
(Cookie\Guard, EncrypterTest) converged to the Contracts exception. Dropped the
dead symfony/security-core require (only referenced by two unused imports).

Full suite 1644 green; ratchet at baseline.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 composer.json                                 |  1 -
 .../Contracts/Encryption/StringEncrypter.php  | 26 +++++++++++
 src/Illuminate/Cookie/Guard.php               |  2 +-
 .../Encryption/DecryptException.php           |  6 ++-
 src/Illuminate/Encryption/Encrypter.php       | 45 ++++++++++++-------
 src/Illuminate/Foundation/Application.php     |  4 ++
 tests/Encryption/EncrypterTest.php            |  2 +-
 7 files changed, 66 insertions(+), 20 deletions(-)
 create mode 100644 src/Illuminate/Contracts/Encryption/StringEncrypter.php

diff --git a/composer.json b/composer.json
index 9f7486080..3bbc12113 100755
--- a/composer.json
+++ b/composer.json
@@ -33,7 +33,6 @@
         "symfony/mime": "~6.4",
         "symfony/process": "~6.4",
         "symfony/routing": "~6.4",
-        "symfony/security-core": "~6.4",
         "symfony/translation": "~6.4",
         "voku/portable-ascii": "2.0.3"
     },
diff --git a/src/Illuminate/Contracts/Encryption/StringEncrypter.php b/src/Illuminate/Contracts/Encryption/StringEncrypter.php
new file mode 100644
index 000000000..399d653fa
--- /dev/null
+++ b/src/Illuminate/Contracts/Encryption/StringEncrypter.php
@@ -0,0 +1,26 @@
+<?php
+
+namespace Illuminate\Contracts\Encryption;
+
+interface StringEncrypter
+{
+    /**
+     * Encrypt a string without serialization.
+     *
+     * @param  string  $value
+     * @return string
+     *
+     * @throws \Illuminate\Contracts\Encryption\EncryptException
+     */
+    public function encryptString(#[\SensitiveParameter] $value);
+
+    /**
+     * Decrypt the given string without unserialization.
+     *
+     * @param  string  $payload
+     * @return string
+     *
+     * @throws \Illuminate\Contracts\Encryption\DecryptException
+     */
+    public function decryptString($payload);
+}
diff --git a/src/Illuminate/Cookie/Guard.php b/src/Illuminate/Cookie/Guard.php
index efe1fde86..62ddc9403 100644
--- a/src/Illuminate/Cookie/Guard.php
+++ b/src/Illuminate/Cookie/Guard.php
@@ -1,7 +1,7 @@
 <?php namespace Illuminate\Cookie;
 
 use Illuminate\Encryption\Encrypter;
-use Illuminate\Encryption\DecryptException;
+use Illuminate\Contracts\Encryption\DecryptException;
 use Symfony\Component\HttpFoundation\Cookie;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
diff --git a/src/Illuminate/Encryption/DecryptException.php b/src/Illuminate/Encryption/DecryptException.php
index b2e4302ff..cc1bb109b 100644
--- a/src/Illuminate/Encryption/DecryptException.php
+++ b/src/Illuminate/Encryption/DecryptException.php
@@ -1,3 +1,7 @@
 <?php namespace Illuminate\Encryption;
 
-class DecryptException extends \RuntimeException {}
+// @deprecated Canonical location is Illuminate\Contracts\Encryption\DecryptException (L13).
+// Runtime alias keeps existing catch sites working until the illuminate/encryption swap;
+// class_alias makes the two names identical so `catch (Illuminate\Encryption\DecryptException)`
+// still catches the thrown contract exception. App repoint is grep-driven (Psalm-blind to alias).
+class_alias(\Illuminate\Contracts\Encryption\DecryptException::class, __NAMESPACE__.'\\DecryptException');
diff --git a/src/Illuminate/Encryption/Encrypter.php b/src/Illuminate/Encryption/Encrypter.php
index 1ff2124af..60c48289d 100755
--- a/src/Illuminate/Encryption/Encrypter.php
+++ b/src/Illuminate/Encryption/Encrypter.php
@@ -1,9 +1,11 @@
 <?php namespace Illuminate\Encryption;
 
-use Symfony\Component\Security\Core\Util\StringUtils;
-use Symfony\Component\Security\Core\Util\SecureRandom;
+use Illuminate\Contracts\Encryption\DecryptException;
+use Illuminate\Contracts\Encryption\EncryptException;
+use Illuminate\Contracts\Encryption\Encrypter as EncrypterContract;
+use Illuminate\Contracts\Encryption\StringEncrypter;
 
-class Encrypter {
+class Encrypter implements EncrypterContract, StringEncrypter {
 
 	/**
 	 * The encryption key.
@@ -71,7 +73,7 @@ public function encrypt($value, $serialize = true): string
         );
 
         if ($value === false) {
-            throw new \RuntimeException('Could not encrypt the data.');
+            throw new EncryptException('Could not encrypt the data.');
         }
 
         // Once we have the encrypted value we will go ahead base64_encode the input
@@ -82,7 +84,7 @@ public function encrypt($value, $serialize = true): string
         $json = json_encode(compact('iv', 'value', 'mac'));
 
         if (! \is_string($json)) {
-            throw new \RuntimeException('Could not encrypt the data.');
+            throw new EncryptException('Could not encrypt the data.');
         }
 
         return base64_encode($json);
@@ -219,6 +221,28 @@ public function getKey(): string
         return $this->key;
     }
 
+    /**
+     * Get the current encryption key and all previous encryption keys.
+     *
+     * @return array
+     */
+    // ponytail: single-key fork; key rotation (previous_keys) arrives with the
+    // illuminate/encryption v13 swap. Contract still satisfied for consumers now.
+    public function getAllKeys(): array
+    {
+        return [$this->key];
+    }
+
+    /**
+     * Get the previous encryption keys.
+     *
+     * @return array
+     */
+    public function getPreviousKeys(): array
+    {
+        return [];
+    }
+
     /**
      * Calculate the hash of the given payload.
      *
@@ -233,15 +257,4 @@ protected function calculateMac($payload, $bytes): string
         );
     }
 
-	/**
-	 * Set the encryption key.
-	 *
-	 * @param  string  $key
-	 * @return void
-	 */
-	public function setKey($key)
-	{
-		$this->key = (string) $key;
-	}
-
 }
diff --git a/src/Illuminate/Foundation/Application.php b/src/Illuminate/Foundation/Application.php
index 8be717229..a6c40860a 100755
--- a/src/Illuminate/Foundation/Application.php
+++ b/src/Illuminate/Foundation/Application.php
@@ -1158,6 +1158,10 @@ public function registerCoreContainerAliases()
 
 		// BC: Log\Writer renamed to Log\Logger (task 3.5); keep old name resolvable.
 		$this->alias('log', 'Illuminate\Log\Writer');
+
+		// Encrypter now implements the L13 contracts (task 2.9); resolve them to 'encrypter'.
+		$this->alias('encrypter', 'Illuminate\Contracts\Encryption\Encrypter');
+		$this->alias('encrypter', 'Illuminate\Contracts\Encryption\StringEncrypter');
 	}
 
 }
diff --git a/tests/Encryption/EncrypterTest.php b/tests/Encryption/EncrypterTest.php
index 8edffc06d..03c729488 100755
--- a/tests/Encryption/EncrypterTest.php
+++ b/tests/Encryption/EncrypterTest.php
@@ -25,7 +25,7 @@ public function testEncryptionWithCustomCipher()
 
     public function testExceptionThrownWhenPayloadIsInvalid()
     {
-        $this->expectException(Illuminate\Encryption\DecryptException::class);
+        $this->expectException(Illuminate\Contracts\Encryption\DecryptException::class);
         $this->expectExceptionMessage("The payload is invalid.");
         $e = $this->getEncrypter();
         $payload = $e->encrypt('foo');

From 46e9710baff402482435393ddf9153fbc8d0c0e6 Mon Sep 17 00:00:00 2001
From: agis <agis.septiyanto@gmail.com>
Date: Sat, 12 Sep 2026 10:25:55 +0700
Subject: [PATCH 2/2] refactor(filesystem): relocate FileNotFoundException to
 Contracts via alias bridge (task 2.10)

Canonical location moves to Contracts\Filesystem\FileNotFoundException (L13).
Filesystem throws/catches the contract exception; the old
Illuminate\Filesystem\FileNotFoundException becomes a class_alias bridge so
existing catch sites keep matching until the illuminate/filesystem swap. Provider
already binds 'files' via singleton() (done in task 3.5), so no provider change.

Full suite 1644 green; ratchet at baseline.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 src/Illuminate/Filesystem/FileNotFoundException.php | 6 +++++-
 src/Illuminate/Filesystem/Filesystem.php            | 1 +
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/src/Illuminate/Filesystem/FileNotFoundException.php b/src/Illuminate/Filesystem/FileNotFoundException.php
index f6ee5dc73..8144e77d6 100644
--- a/src/Illuminate/Filesystem/FileNotFoundException.php
+++ b/src/Illuminate/Filesystem/FileNotFoundException.php
@@ -1,3 +1,7 @@
 <?php namespace Illuminate\Filesystem;
 
-class FileNotFoundException extends \Exception {}
+// @deprecated Canonical location is Illuminate\Contracts\Filesystem\FileNotFoundException (L13).
+// Runtime alias keeps existing catch sites working until the illuminate/filesystem swap;
+// class_alias makes the two names identical so `catch (Illuminate\Filesystem\FileNotFoundException)`
+// still catches the thrown contract exception. App repoint is grep-driven (Psalm-blind to alias).
+class_alias(\Illuminate\Contracts\Filesystem\FileNotFoundException::class, __NAMESPACE__.'\\FileNotFoundException');
diff --git a/src/Illuminate/Filesystem/Filesystem.php b/src/Illuminate/Filesystem/Filesystem.php
index 2cb2abf08..b35ed14e6 100755
--- a/src/Illuminate/Filesystem/Filesystem.php
+++ b/src/Illuminate/Filesystem/Filesystem.php
@@ -4,6 +4,7 @@
 use Symfony\Component\Finder\Finder;
 use Illuminate\Support\Traits\Macroable;
 use Illuminate\Support\Traits\Conditionable;
+use Illuminate\Contracts\Filesystem\FileNotFoundException;
 
 class Filesystem {