Templated Uri Router Laravel Package

Technical Evaluation

Architecture fit. hautelook/templated-uri-router is a Symfony router replacement that emits RFC 6570 URI templates (e.g. /users/{id}{?fields,sort}) instead of fully expanded URLs. It is designed to plug into the Symfony Routing component's UrlGeneratorInterface so that hypermedia consumers (HAL, JSON:API, Siren) can discover and expand links client-side. Laravel does not expose that seam: Illuminate\Routing\UrlGenerator is a concrete, framework-owned class wired through the url singleton, and Laravel route definitions live in routes/*.php rather than in a Symfony RouteCollection. Adopting this package means either (a) replacing a Laravel kernel component that the framework does not contractually support replacing, or (b) running a second, parallel router whose only job is link generation. Both are architecturally intrusive for a narrow, presentation-layer concern.

Integration feasibility. Effectively low. There is no Laravel service provider, no facade, no config bridge, and no Laravel-ecosystem dependents. The realistic integration is a hand-written wrapper that constructs a Symfony RouteCollection from Laravel route metadata, instantiates the templated generator, and exposes it behind a Laravel facade. That is bespoke glue code your team owns forever, duplicating route definitions that already exist in routes/api.php. The alternative — authoring API routes in Symfony YAML to satisfy the generator — is a non-starter for a Laravel codebase.

Technical risk. High on every axis:

• Provenance. The package name on Packagist (hautelook/templated-uri-router) does not match the assessed repository (goetas/TemplatedUriRouter). The canonical upstream is ambiguous, which complicates CVE triage, provenance attestation, and fork decisions. This needs resolving before any code review, let alone adoption.
• Viability. 2 stars, 0 dependents, zero community validation, single-maintainer lineage. There is no observable security disclosure path.
• Version drift. Last release 2023-01-19. Symfony Routing has moved through 6.x and 7.x since; Laravel 11/12 pin symfony/routing at versions this package's constraint almost certainly does not cover. Expect Composer resolution conflicts or an unverified override.
• Blast radius. Swapping a router component touches URL generation everywhere — signed URLs, redirects, mail templates, pagination — not just the one API endpoint that motivated the request.

Key questions.

1. What is the actual requirement — templated link emission for a hypermedia API, or something else? If it is only link emission, the router is the wrong abstraction entirely.
2. Who is the canonical maintainer of record, and is there a private fork available?
3. Has anyone verified PHP 8.3/8.4 and symfony/routing ^7 compatibility, or are we assuming it?
4. What is the cost of the alternative (a standalone RFC 6570 expander) versus this package?
5. Which existing Laravel routes would need mirrored definitions, and who owns keeping them in sync?

Integration Approach

Stack fit. Poor as a router; acceptable only if decomposed. The genuinely reusable capability is RFC 6570 template expansion, which is already available in well-maintained libraries — guzzlehttp/uri-template (PHP 8, actively released, PSR-7 friendly) or rixth/uritemplate. For a Laravel/HAL or JSON:API surface, the correct pattern is an ApiResource/link-builder service that composes templates from Laravel's own route table and expands them on demand — no router replacement.

Migration path. Do not migrate at the router level. Introduce a TemplatedLinkGenerator contract behind a facade, backed initially by guzzlehttp/uri-template reading named routes from Route::getRoutes(). Existing route() call sites remain untouched; only new hypermedia link builders consume the new contract. If a future requirement genuinely demands the Symfony generator's specific behavior, it can be swapped in behind the same contract without touching call sites — this preserves optionality at near-zero cost.

Compatibility. The package's Composer constraints should be treated as unknown until audited. A standalone expander has no framework coupling and no conflict surface. If the Symfony router route is pursued, budget for a symfony/routing version pin override and a PHP 8.x compatibility pass — both are unplanned work that will surface mid-sprint.

Sequencing.

1. Confirm the API contract requirement and pick the hypermedia profile (HAL vs JSON:API) — this determines whether templated links are needed at all.
2. Spike (≤2 days) with guzzlehttp/uri-template behind a TemplatedLinkGenerator interface.
3. Build link generation into the API Resource layer; add contract tests asserting template shape and RFC 6570 encoding of reserved characters.
4. Only if step 2 fails a documented requirement, evaluate wrapping the Symfony generator behind the existing interface — never a kernel swap.
5. Gate any adoption of the package itself behind a provenance and Composer-constraint audit.

Operational Impact

Maintenance. This is the decisive factor. A package with 2 stars, 0 dependents, and a 2023 release date is not a dependency — it is a fork obligation. If adopted, assume you own the code: private VCS mirror, internal release tagging, and a named maintainer. That is a permanent headcount tax for a capability available from a maintained library.

Support. No vendor, no community, no CVE feed, no issue-triage SLA. Security response becomes internal detection plus internal patching. For a component that sits on the URL-generation path — including signed URLs — that is a meaningful risk posture change.

Scaling. Negligible. Link generation is O(routes) at boot and O(1) per request, cacheable alongside the route cache. Neither the package nor the alternative is a throughput concern; the cost here is entirely engineering and ownership, not runtime.

Failure modes.

• Silent route drift: the parallel Symfony RouteCollection diverges from routes/api.php, producing links to non-existent endpoints that return 404 only in production.
• Composer conflict: a symfony/routing constraint clash blocks a Laravel upgrade, forcing either a fork or a frozen framework version.
• Encoding errors: incorrect handling of reserved characters or explode modifiers generates malformed query strings that clients silently mis-expand.
• Upgrade deadlock: no upstream PHP 8.x/Symfony 7 support means the package becomes the pin that blocks a platform upgrade.
• Provenance gap: an unpatched transitive issue with no upstream to notify.

Ramp-up. Meaningful. Engineers need RFC 6570 literacy — operators ({?}, {&}, {+}, {#}), explode modifiers (*), and the level 1–4 conformance tiers — plus the chosen hypermedia profile's link conventions. Estimate 1–2 days per engineer, on top of the bespoke glue. The alternative library carries the same template-literacy cost but removes the framework-integration cost entirely.

Recommendation. Decline adoption. The package's only unique value (template emission from a Symfony RouteCollection) does not exist in a Laravel application, and its support profile is de facto abandoned. Deliver the underlying requirement — RFC 6570 templated links for a hypermedia API — with guzzlehttp/uri-template behind an internal TemplatedLinkGenerator interface. Revisit the Symfony generator only if the interface spike fails a documented contract, and then only behind that interface, not as a router substitution.