feat!: rebuild timezone handling for PHP 8.3 and Symfony 7.4–8.1

.gitattributes

@@ -0,0 +1,16 @@
+/.github export-ignore
+/.github/** export-ignore
+/.firecrawl export-ignore
+/.firecrawl/** export-ignore
+/.claude export-ignore
+/.claude/** export-ignore
+/Tests export-ignore
+/Tests/** export-ignore
+/scripts export-ignore
+/scripts/** export-ignore
+/.gitattributes export-ignore
+/.gitignore export-ignore
+/.travis.yml export-ignore
+/phpunit.xml.dist export-ignore
+/phpstan.neon.dist export-ignore
+/package.json export-ignore

.github/workflows/tests.yml

@@ -0,0 +1,112 @@
+name: Tests
+
+on:
+    push:
+    pull_request:
+
+permissions:
+    contents: read
+
+jobs:
+    minimal-dependencies:
+        runs-on: ubuntu-latest
+        steps:
+            - uses: actions/checkout@v4
+              with:
+                  persist-credentials: false
+            - uses: shivammathur/setup-php@v2
+              with:
+                  php-version: '8.3'
+                  coverage: none
+                  tools: composer:v2
+            - run: composer validate --strict --no-check-publish
+            - run: composer update --no-dev --prefer-dist --no-interaction --no-progress
+            - run: composer audit --locked
+            - name: Smoke-test no-dev package
+              run: php scripts/no-dev-smoke.php
+
+    test:
+        runs-on: ubuntu-latest
+        strategy:
+            fail-fast: false
+            matrix:
+                include:
+                    - php: '8.3'
+                      symfony: '7.4.*'
+                    - php: '8.4'
+                      symfony: '7.4.*'
+                    - php: '8.4'
+                      symfony: '8.1.*'
+                    - php: '8.5'
+                      symfony: '8.1.*'
+
+        name: PHP ${{ matrix.php }} / Symfony ${{ matrix.symfony }}
+
+        steps:
+            - uses: actions/checkout@v4
+              with:
+                  persist-credentials: false
+
+            - uses: shivammathur/setup-php@v2
+              with:
+                  php-version: ${{ matrix.php }}
+                  coverage: none
+                  tools: composer:v2
+
+            - run: composer validate --strict --no-check-publish
+
+            - name: Select Symfony runtime versions
+              run: >-
+                  composer require --no-update
+                  symfony/config:${{ matrix.symfony }}
+                  symfony/dependency-injection:${{ matrix.symfony }}
+                  symfony/http-foundation:${{ matrix.symfony }}
+                  symfony/http-kernel:${{ matrix.symfony }}
+
+            - name: Select Symfony development versions
+              run: >-
+                  composer require --dev --no-update
+                  symfony/asset-mapper:${{ matrix.symfony }}
+                  symfony/console:${{ matrix.symfony }}
+                  symfony/event-dispatcher:${{ matrix.symfony }}
+                  symfony/form:${{ matrix.symfony }}
+                  symfony/framework-bundle:${{ matrix.symfony }}
+                  symfony/messenger:${{ matrix.symfony }}
+                  symfony/routing:${{ matrix.symfony }}
+                  symfony/security-bundle:${{ matrix.symfony }}
+                  symfony/security-core:${{ matrix.symfony }}
+                  symfony/security-csrf:${{ matrix.symfony }}
+                  symfony/serializer:${{ matrix.symfony }}
+                  symfony/twig-bundle:${{ matrix.symfony }}
+                  symfony/web-profiler-bundle:${{ matrix.symfony }}
+
+            - run: composer update --prefer-dist --no-interaction --no-progress
+            - run: composer audit --locked
+            - run: composer check
+
+    prefer-lowest:
+        runs-on: ubuntu-latest
+        steps:
+            - uses: actions/checkout@v4
+              with:
+                  persist-credentials: false
+            - uses: shivammathur/setup-php@v2
+              with:
+                  php-version: '8.3'
+                  coverage: none
+                  tools: composer:v2
+            - run: composer validate --strict --no-check-publish
+            - run: composer update --prefer-lowest --prefer-dist --no-interaction --no-progress
+            - run: composer audit --locked --no-dev
+            - run: composer check
+
+    javascript:
+        runs-on: ubuntu-latest
+        steps:
+            - uses: actions/checkout@v4
+              with:
+                  persist-credentials: false
+            - uses: actions/setup-node@v4
+              with:
+                  node-version: '24'
+            - run: npm test

.gitignore

@@ -0,0 +1,6 @@
+/vendor/
+/var/
+/.phpunit.cache/
+/composer.lock
+/.claude/
+/.firecrawl/

CHANGELOG.md

@@ -0,0 +1,18 @@
+# Changelog
+
+## Unreleased — 2.0
+
+- Replaced the legacy Guesser/Event API with ordered, explicitly tagged timezone resolvers and traceable resolution results.
+- Added validated `TimezoneId`, per-request current-timezone provider, and bounded execution context without global timezone mutation.
+- Added versioned session persistence, signed HMAC/HKDF cookie persistence, and a request/response-aware custom storage contract.
+- Added opt-in browser timezone synchronization with CSRF, strict JSON protocol, and a dependency-free ES module.
+- Added explicit authenticated-user and OIDC contracts, MaxMind City support, and locale mapping/unique-country inference.
+- Added optional Twig, Form, Messenger, profiler, and console integrations. Messenger middleware is published for application bus configuration and does not mutate buses.
+- Added independent resolution and persistence failure strategies, structured redacted logging, diagnostics, supported-version CI, and V2 migration documentation.
+- Added the explicitly registered `CallableTimezoneResolver` convenience adapter for application callables, with typed policy-controlled failures and strict result/source validation.
+- Hardened container compilation: integration keys are strict; cookie and MaxMind identifiers are validated; aware-user/accessor exceptions become typed resolver failures; and configured-service alias cycles are rejected.
+- Scoped clock selection to the bundle's internal alias without defining or replacing the application's global PSR clock alias.
+- Hardened browser/session and diagnostics behavior: sessionless session-storage writes return `503`, and profiler data survives profile serialization/reload.
+- Hardened distribution and CI checks with automatic bundle AssetMapper discovery, clean Composer `--no-dev` smoke coverage, a production-dependency audit at the dependency floor, and archive retention of linked scope/plan docs and the root `LICENSE`.
+- Requires PHP `^8.3` and Symfony `^7.4.13 || ^8.1`: unmaintained Symfony 8.0, the older 6.4 LTS, and end-of-life PHP 8.2 are outside the supported range, and the floor excludes the versions affected by CVE-2026-48736.
+- Removed the bundle Validator integration and the Symfony Validator requirement. V2 has no 1.x compatibility layer.