Console Laravel Package

Product Decisions This Supports

• Whether to ship IndexNow submission as a product feature at all. This package makes "ping search engines when public URLs change" a configuration task rather than a build: submit/validate/key-management/check commands, multi-adapter support (Laravel, Symfony, Yii2, Yii3), and a stable core. It moves the build-vs-buy answer toward buy for any team already on Laravel.
• Indexing as part of the publishing pipeline, not a side project. For a CMS, blog, docs site, or marketplace with frequently changing public URLs, IndexNow submission can be scoped as a roadmap item behind "publish/update/unpublish" events rather than a standalone integration project.
• Reducing adapter glue as a maintenance decision. 0.5.0 promotes the command bodies, sampler, and ORM loader skeleton into the package: an adapter now registers command classes instead of writing eleven near-identical ones. For a PM this is a "our fork/patch surface shrinks" signal — less internal code to own, review, and upgrade.
• Whether to standardize on artisan-native commands. Artisan resolves any symfony/console command, so the Laravel adapter (0.15.0) registers these classes directly. That removes custom $signature rendering and makes indexnow:submit-model, indexnow:check, indexnow:config, indexnow:key:generate first-class DX for the team and for support engineers.
• How much custom-model support we must fund. AbstractSubjectLoader (extend it, implement findOne/findMany) and SubjectSampler turn "support our non-standard Eloquent models" into a small, documented extension point rather than a fork. Scope custom work to the query, not the plumbing.
• Secret handling and support-workflow policy. 0.5.0 fixes indexnow:config masking adapter-only keys (previously history.pdo.dsn with its database password was printed in the table, in --json, and in the "configuration does not build" output intended for bug reports), creates the env file at 0600 before writing the key, warns on pre-existing wider permissions, and stops corrupting rotated keys containing $ or \. This is the difference between "we can ask a customer to paste indexnow:config output" and "we cannot".
• Upgrade-risk budgeting. The removal of CommandDefinition::laravelSignature() is a real breaking change for anyone who rendered artisan signatures from definitions. Decide now whether we own a copy of the 32-line renderer from 0.4 or migrate to registering the package's command classes.
• Version-pinning policy across the family. sitemap and history now pin ^0.5, the adapters move together, and core requires ^0.13. That is a coordinated upgrade unit, which belongs in the dependency/upgrade plan rather than being discovered mid-sprint.

When to Consider This Package

Consider it when:

• You run a Laravel app whose public URLs change regularly and want IndexNow coverage (Bing, Yandex, Seznam, Naver) without writing and maintaining a client.
• You want the feature exposed as artisan commands with no custom command code — submitting subjects, submitting by model class, validating, dumping masked config, generating/rotating keys.
• Your data sources are Eloquent models, or close enough that extending AbstractSubjectLoader (two methods) is acceptable work.
• You need sampling/validation (--sample-class, per-class caps) to verify payloads before turning submission loose on production.
• You are comfortable on a pre-1.0 line: 0.5.0 is a minor bump precisely because optional packages and adapters must move in lockstep, and ConfigSourceInterface is declared "Implement" tier (no method additions before a major, or before a minor listed under Changed while pre-1.0).
• You need config output that is safe to attach to a ticket or a bug report — the masking and 0600/rotation fixes are the reason to be on 0.5.0 rather than 0.4.x.
• You already relied on laravelSignature() and are willing to migrate: either register the package's command classes via $this->commands([...]), or vendor the renderer from 0.4.

Look elsewhere, or defer, when:

• You have no meaningful public-URL churn, or indexing is already handled by the platform/CDN.
• Your organization cannot absorb pre-1.0 API movement — pin exactly and schedule upgrades deliberately, or wait for a 1.0 with a stability promise.
• Your subject data is not ORM-backed and you would be fighting the loader abstraction rather than implementing two methods.
• You require a long-term support commitment or a published deprecation calendar; none is stated here beyond the tier notes.
• You need zero-diff upgrades across adapters: sitemap/history pinning ^0.5 and the core ^0.13 requirement mean coordinated releases, not piecemeal bumps.

How to Pitch It (Stakeholders)

For executives: IndexNow submission is now a small, well-bounded capability rather than a bespoke integration. This release consolidates duplicated per-framework command code into the package itself, so our engineering cost shifts from writing and maintaining glue to configuring a few commands. It also closes three security issues that mattered to us operationally — credentials and connection strings no longer leak through the config command's table, JSON, or bug-report output; generated env files are created with restrictive permissions and pre-existing loose files are flagged; and key rotation no longer corrupts keys containing $ or \. The caveat is maturity: this is a 0.x line with a deliberate breaking removal (CommandDefinition::laravelSignature()), so we should pin versions, adopt the Laravel adapter and optional packages as one upgrade unit, and budget a short migration if we ever rendered artisan signatures ourselves.

For engineering: 0.5.0 moves the command classes, SubjectSampler, AbstractSubjectLoader, and Console\ConfigSourceInterface into the package with constructor injection for everything adapter-specific (runner, Vocabulary, env-file path, Check\SampleOptions). The Laravel adapter (0.15.0) drops its own artisan command classes and lets Illuminate\Console\Application::resolve() pick up the package's symfony/console commands; SubmitSubjectsCommand/ExplainCommand take a configurable $classArgument so Laravel keeps 'model' and Artisan::call('indexnow:submit-model', ['model' => Post::class]) continues to work. Use SubmitSubjectsOptions::DEFAULT_LIMIT instead of a literal 1000 for non-numeric --limit. Required action: audit for CommandDefinition::laravelSignature() usage — it is gone; register the package's command classes or carry the 0.4 renderer. Requires indexnowkit/core ^0.13, and upgrade sitemap/history together at ^0.5.