Verify Laravel Package

Product Decisions This Supports

Feature / roadmap

• Deciding whether automated URL submission (IndexNow) is a real lever for a KPI — time-to-index, organic sessions on new pages, catalog/listing freshness — rather than a nice-to-have. This package covers the submission path; the roadmap question is which surfaces (publish events, price/stock updates, new docs, news) fire it.
• Choosing the gating posture: verify.* is a quality gate, not plumbing. 0.4.0 makes that gate deterministic — the pre-flight no longer inherits the application's http.client, so an instrumented or proxy client that follows redirects can no longer silently neutralise verify.redirect, verify.max_redirects, the redirect-target host check and loop detection. That turns "which HTTP client happened to be bound" into an explicit config decision.

Build vs buy

• The POST to the IndexNow endpoint is a few lines. Nearly all the cost and risk sits in the pre-flight: robots.txt fetching and caching, per-host forbidden counters, canonical resolution, redirect semantics, queue time budgets. Three of the four fixes in 0.4.0 are in that layer. Adopt the pre-flight; keep product logic (what to submit, when, per-tenant policy) in the app.

Measurement / data-quality decisions

• 0.4.0 fixes a class of silent, closed-direction refusals: a relative <link rel="canonical"> now resolves against the document's <base href> (itself resolved against the page URL), as a crawler would. Previously, any site whose templates emit a <base> had canonicals computed against the fetched URL, failed to match, and was dropped as non-canonical. Treat this upgrade as recovering lost submissions, not as growth — instrument refusals before and after, or you will misread the delta.
• Because pre-flight traffic no longer rides http.client, tracing/proxy visibility into verification is gone by design. The follow-on decision: source submission telemetry from the package's own events and the verify.transport line of check, not from the HTTP layer.

Operational decisions

• verify.time_budget is now read before verify.delay waits, so backoff can no longer overrun the visibility timeout of the queue job the budget exists to fit. Supports a decision to run submissions on the queue (Horizon/SQS) without duplicated work or extended leases.
• RobotsCache::key() now strips [, ], : from IPv6 hosts, matching the core's Retry\ForbiddenCounter. Strict PSR-16 stores stop rejecting the key and degrading to one robots.txt fetch per process.

Dependency / extension-point policy

• Adapters should call the core's OptionalPackage::verify() directly; this package's VerifyServices::package() is now a pass-through. Zero action if you have no custom adapters; a one-line migration if you do.
• Requires indexnowkit/core ^0.13 — upgrading this package is a core upgrade. Plan and pin the pair together.

When to Consider This Package

Consider adopting when:

• You run Laravel, generate or mutate URLs at a rate where indexing latency matters, and want submission triggered on publish/update events or a schedule.
• You want the etiquette handled: robots.txt fetch + cache, per-host 403/forbidden counters, canonical resolution including <base href>, redirect semantics, and a budget that fits inside a queue job.
• You can accept a fail-closed pre-flight: pages that look non-canonical, redirect, or are robots-disallowed are dropped rather than submitted. Correct for most content sites — but only if refusals are observable, since "URL exists" is not "URL submitted."
• You use standard PSR-18/PSR-17 discovery and a normal PSR-16 cache. IPv6 hosts on strict stores are safe as of 0.4.0.

Look elsewhere or defer when:

• Pre-flight HTTP traffic must flow through a mandated corporate proxy, an instrumented client, or a shared tracing stack. 0.4.0 deliberately removed http.client from the pre-flight and states why; do not plan on it being reverted. POST submissions still honour http.client; verification does not. If that is a hard compliance line, this is a poor fit today.
• Your canonical URLs are intentionally non-canonical (e.g. query-parameterised variants you want submitted anyway) — the gate will drop them.
• You are not on Laravel or don't want a framework adapter — use indexnowkit/core directly.
• You need proof of indexing rather than submission. IndexNow is fire-and-forget; this package reports what it sent, not what got indexed. "Prove Google indexed this page" is a different product.
• You have no appetite for split-package churn: 0.4.0 is a coordinated core bump plus an adapter API move.

How to Pitch It (Stakeholders)

For executives. This is the piece that makes "tell search engines immediately when a page changes" safe and boring. The submission call is trivial; the value is the pre-flight that stops us pinging engines about pages we shouldn't — duplicate/non-canonical URLs, redirects, robots-disallowed paths — plus scheduling that fits inside a queue job instead of blowing its timeout. 0.4.0 is a correctness release with no new product surface: the headline fix means sites whose templates emit a <base> tag stop silently losing their submissions, and the pre-flight can no longer have its redirect and host checks disabled by whichever HTTP client the app happens to bind. Upgrade cost is a core dependency bump (indexnowkit/core ^0.13), and — only if we maintain custom adapters — a one-line call move. The single trade-off to accept knowingly: pre-flight requests no longer pass through our instrumented/proxied HTTP client, so verification telemetry must come from the package's own logs and check output.

For engineering. VerifyConfig::transportConfig() drops http.client, and Adapter\VerifyServices::transport() ignores the client locator: the pre-flight always builds the core-discovered PSR-18 client with max_redirects: 0 and verify.timeout. The rationale is sound — PSR-18 gives no way to tell a handed-over client not to follow redirects, so a redirect-following client saw the final 200 and silently disabled verify.redirect, verify.max_redirects, the redirect-target host check and loop detection. Consequence: no proxy or instrumentation coverage on pre-flight; use the verify.transport line of check to see which client does what, and emit outcome telemetry from the package rather than the HTTP client. POST submissions still carry http.client, so proxying/instrumentation keeps applying there. Also in this release: relative canonical resolves against <base href> as a crawler does; verify.time_budget is sampled before verify.delay so delay + budget can't overrun the job's visibility timeout; RobotsCache::key() strips IPv6 reserved characters so strict PSR-16 stores no longer degrade to one fetch per process. Adapters should call OptionalPackage::verify() (core 0.13) directly — same object, same texts.