I don't think we actually need to do this, once we remove __init__.php.

The theory is that you tell libphutil about all the libraries up front, and then it can load from any of them, so circular dependencies and out-of-order dependencies should work fine (even if they're not advisable).

D2545 broke this, but the intent was fine (load all functions when we load a library). The problem was that currently we incur some unavoidable side effects when we do this (load all dependencies as defined by __init__.php). Once __init__.php is gone, these side effects should go away too.

The only cases that could still break are files that, e.g., define a function and a class, but this is already nonstandard given the enforced "one class per file rule". We can encode it strictly if necessary.

Specifically, the libphutil rules that do need to be adhered to are:

• One class per file.
• If a file defines a class, it defines nothing else (i.e., don't put classes and functions in the same file).
• No side effects of any kind ever in library code (i.e., you can not run any code alongside definitions of classes and functions). Run code explicitly from the toplevel only, never as a side effect of inclusion.

I think everything already follows these, though?

The theory is that you tell libphutil about all the libraries up front, and then it can load from any of them, so circular dependencies and out-of-order dependencies should work fine (even if they're not advisable).

What I wanted to avoid was having to explicitly list in the www .arcconfig the dependencies of other libraries, i.e. libraries that www does not use directly, but only through libraries it uses.

Oh! Yeah, that makes perfect sense.

Forgive my ignorance, but isn't this what Composer does?

Yes. This project does not use Composer. See T6012. See also T5055.

Thanks for the response. I have similar concerns about security and using Composer in my own personal projects.
Perhaps similar logic to bower could be leveraged (which I think is more security conscious).
I'd hate to have to reinvent the wheel for library dependencies.