Laravel

.env holds this machine's real settings and secrets and is git-ignored; .env.example is the committed template listing every variable the app needs, with placeholder values. Laravel copies .env.example to .env on install.

app holds your classes, bootstrap boots the framework and keeps its caches, config holds settings arrays, database holds migrations, factories and seeders, public is the web root, resources holds views and raw assets, routes the route files, storage runtime files and logs.

composer run dev calls php artisan dev, which by default runs the PHP development server, a queue listener, Pail log tailing and the Vite dev server together. artisan serve alone only answers HTTP, so queued jobs and Vite assets are left without a process.

composer create-project laravel/laravel copies the bare skeleton and runs its Composer scripts (.env, app key, SQLite file, migrations). laravel new wraps that step and adds prompts, an optional starter kit, Pest by default, a front-end build and Boost.

public/index.php is the entry point: it checks for maintenance mode, loads Composer's autoloader, requires bootstrap/app.php to get the application, and calls handleRequest(Request::capture()). bootstrap/app.php builds and returns that application with Application::configure()->...->create().

Laravel's container auto-wires any concrete class by reflecting on its constructor type hints. An interface or abstract class needs a binding, or a binding attribute, to an implementation, and a required scalar with no default needs its value supplied.

All three reach the same container-managed cache service, so behaviour matches. The facade and cache() helper call it from inside method bodies; an injected Repository contract declares the dependency in the constructor, which is explicit and framework-portable.

register() should only bind services into the container; boot() configures the app with them, such as macros, view composers, gates and event listeners. Laravel runs every provider's register() before any boot(), so boot() can rely on every registered service.

bind() builds a new object on every resolution; singleton() builds once, lazily, and returns that object afterwards; scoped() is a singleton forgotten when a queue job or Octane request starts; instance() stores an object you already built.

Cache extends Illuminate\Support\Facades\Facade, whose __callStatic() catches the missing static call, resolves the container binding named by getFacadeAccessor() ('cache', a CacheManager) and calls get() on that object.

When an action type-hints an Eloquent model and names the variable after the route segment, Laravel queries that model by its route key (the primary key by default) and injects it. No matching row throws ModelNotFoundException, rendered as a 404.

Chain ->name('franchise.orders.show') on the route, then call route('franchise.orders.show', ['order' => 42]); matching keys fill the placeholders, leftover keys become the query string, and the URL is absolute unless the third argument is false.

Wrap a URI segment in braces, {year}, to capture it, and add a question mark, {month?}, to make it optional; the handler argument for an optional segment needs a default value, such as ?string $month = null.

Route::get registers GET and HEAD; post, put, patch, delete and options register one verb each; Route::match registers the verbs you list (plus HEAD when GET is listed); Route::any registers all seven router verbs. php artisan route:list shows each route's verbs, URI, name and action.

routes/web.php is loaded inside the web middleware group for browser pages with sessions and CSRF protection; routes/api.php, created by php artisan install:api, is loaded inside the stateless api group under an automatic /api prefix.

make:controller writes a class into app/Http/Controllers whose public methods are actions. A route targets one with the array [CarController::class, 'show']; on a match Laravel builds the controller through the container and calls that method with the route parameters.

Route::resource('books', ...) registers seven routes: GET /books (index), GET /books/create (create), POST /books (store), GET /books/{book} (show), GET /books/{book}/edit (edit), PUT/PATCH /books/{book} (update) and DELETE /books/{book} (destroy), named books.index and so on.

A controller implementing HasMiddleware defines a static middleware() method returning middleware names, closures or Middleware objects; new Middleware('log', only: ['index']) limits one to listed methods and except excludes methods. It replaces constructor $this->middleware() calls.

Route::apiResource registers the resource routes minus the create and edit form pages, leaving index, store, show, update and destroy. only([...]) keeps just the listed actions and except([...]) removes listed ones; make:controller --api stubs the matching five methods.

The base Controller in a Laravel 13 skeleton is an empty abstract class: no parent, no AuthorizesRequests or ValidatesRequests traits. $this->authorize() and $this->validate() are undefined unless you add those traits back; the usual replacements are Gate::authorize() and $request->validate().

make:middleware creates a class in app/Http/Middleware with handle(Request $request, Closure $next): Response. Returning $next($request) passes the request inward; returning your own response, such as a redirect, stops it before the controller runs.

Laravel's HandleCors middleware answers CORS requests: it sits in the default global stack and reads the cors config. A new app runs on the framework's built-in defaults until you run php artisan config:publish cors and edit config/cors.php.

The web group adds EncryptCookies, AddQueuedCookiesToResponse, StartSession, ShareErrorsFromSession and PreventRequestForgery before SubstituteBindings; the api group has only SubstituteBindings. API routes therefore never start a session, decrypt cookies or check CSRF tokens.

Global middleware is registered in bootstrap/app.php inside withMiddleware(), using $middleware->append() or prepend(); it wraps every request before routing. Route middleware is attached with ->middleware() on a route or group, by class name or alias.

Record hrtime(true) before calling $next, store $response = $next($request), compute the elapsed milliseconds, set a header on $response, call Log::warning() when it exceeds a threshold, and return the response.

An API resource is a class extending JsonResource whose toArray() maps one model to the exact JSON the API promises, so column renames, new columns and internal fields do not leak into responses by accident.

input() reads a field from the request body and query string together (body wins on a clash) and follows dot paths; query() reads only the query string; all() returns every field plus uploaded files; only() and except() return a filtered subset.

All five return an Illuminate\Http\RedirectResponse with status 302 unless you pass another code. to() takes a path or URL, route() and to_route() a route name, back() the previous page, and away() an external URL used as-is.

Laravel's router wraps the return value: a string or view becomes an HTML response with status 200, while arrays, Eloquent models and collections become a JsonResponse. A model created during the request returns 201 instead of 200.

Through $request->session(), the session() helper or the Session facade: put() stores a value, get() reads it with an optional default, push() appends to an array value, pull() reads and removes in one call, and forget() deletes keys; flush() empties the session.

casts() returns a map of attribute names to cast types such as boolean, datetime, decimal:2, enum classes and cast classes, applied on every read and write. The older $casts property still works; casts() is merged over it and can call static helpers.

$hidden removes attributes and relations from toArray() and JSON, $visible keeps only those listed, and $appends adds accessor values that have no column. Laravel 13 also offers #[Hidden], #[Visible] and #[Appends] class attributes; none of them changes what is queried.

Eloquent assumes the snake_case plural of the class name as the table, an auto-incrementing integer id key, and managed created_at and updated_at columns. Override them with the $table, $primaryKey, $keyType, $incrementing and $timestamps properties, or Laravel 13's #[Table] attribute.

find(), first() and firstWhere() return null when nothing matches, while findOrFail() and firstOrFail() throw ModelNotFoundException. Choose the null-returning form when absence is normal and the OrFail form when absence is an error.

Post::with('author') runs the posts query, then one extra query that fetches every needed author by id and attaches each to its post. The Blade loop then reads already-loaded authors: two queries instead of one per post.

SQLite: config/database.php sets 'default' => env('DB_CONNECTION', 'sqlite') and the skeleton's .env.example sets DB_CONNECTION=sqlite, pointing at database/database.sqlite. DB::connection('pgsql') returns any other connection named in the 'connections' array.

make() builds model instances from the factory's definition() without saving them; create() builds them the same way and then persists each one with save(). Both return a single model, or an Eloquent Collection once count() is set.

A seeder is a class in database/seeders with a run() method; DatabaseSeeder is the root and runs others through $this->call(). php artisan db:seed runs DatabaseSeeder, --class runs one seeder, and migrate --seed seeds after migrating.

It writes a timestamped file in database/migrations that returns an anonymous class extending Migration, with up() creating the listings table and down() dropping it. migrate runs pending up() methods as one batch; migrate:rollback runs down() for the last batch.

paginate() runs a COUNT query plus a LIMIT/OFFSET query and returns a LengthAwarePaginator with totals and page numbers; simplePaginate() runs one LIMIT/OFFSET query for next/previous only; cursorPaginate() filters on the ordered columns instead of using an offset.

Cache::lock($name, $seconds)->get() tries once and returns true or false immediately; block($wait) keeps retrying and throws LockTimeoutException after $wait seconds. Both accept a closure and release the lock automatically when it finishes.

Cache::remember($key, $ttl, $closure) returns the cached value when the key exists; on a miss it runs the closure, stores the result for the TTL (integer seconds or a DateTime) and returns it, so the expensive lookup runs once per TTL window.

A Laravel 13 skeleton uses the database store: CACHE_STORE in .env feeds the default key of config/cache.php, which names one entry in its stores array. The failover store tries its listed stores in order and moves on only when one throws.

Cross-server locks need a shared store: database, redis, memcached or dynamodb; file covers one machine and array one process. The Laravel 13 database default uses the cache_locks table; Redis uses its lock_connection, the default connection.

Acquire the lock in the controller, pass $lock->owner() into the job, and inside the job call Cache::restoreLock($name, $owner)->release(). The restored object carries the same owner token, so its owner-checked release() succeeds.

A class-based component pairs a PHP class in app/View/Components with a view and takes props through its constructor; an anonymous component is just a Blade file in resources/views/components using @props. Pick a class for logic or injected services.

Blade sets a $loop object on every @foreach iteration with index (from 0), iteration (from 1), count, remaining, first, last, odd, even, depth and parent, so rows can be styled without a hand-kept counter.

Blade compiles {{ $value }} to an echo through the e() helper, which runs htmlspecialchars so markup prints as text; {!! $value !!} echoes the value untouched, so it is safe only for HTML your own code built or sanitized.

A layout component wraps the page: markup between <x-layout> tags lands in the component's {{ $slot }}. An @extends layout is inheritance: the child fills @section blocks that the layout prints with @yield. New apps usually choose components.

merge() adds default attributes: class and style defaults are joined with the caller's values, while any other default is replaced by the caller's value. class() adds classes conditionally; prepends() makes a non-class default join instead.

Laravel 13 offers React, Vue and Svelte kits built on Inertia with TypeScript, Tailwind and a shadcn component library, and a Livewire kit with Flux UI. Each creates a full app with Fortify-backed login, registration, password reset, 2FA and settings pages.

@vite prints the script and stylesheet tags for the entry points you name. With npm run dev it points them at the Vite dev server (plus the @vite/client HMR script); after npm run build it reads public/build/manifest.json and links the hashed, compiled files.

A starter kit copies a whole application into your repository; there is no kit package to update. You edit its screens, actions and routes freely and keep the underlying packages (framework, Fortify, Inertia or Livewire, Flux) current with Composer and npm.

Blade, Livewire and Inertia all keep routing in Laravel's route files and controllers; only a separate SPA moves routing into a client-side router over a JSON API. UI state lives in the server render (Blade), a component snapshot (Livewire), or client components (Inertia, SPA).

Laravel's Vite class calls isRunningHot(), which is just is_file() on public/hot. If the file exists, every tag points at the URL inside it; otherwise tags come from public/build/manifest.json. A stale hot file or a missing manifest breaks every page.

php artisan list prints every registered command grouped by namespace, php artisan help <command> shows one command's arguments and options, and php artisan about summarises versions, environment, debug mode, cache status and drivers.

make:* commands generate boilerplate classes from stub templates into the conventional folders. make:model Shipment -a also creates a migration, factory, seeder, policy and a resource controller wired to StoreShipmentRequest and UpdateShipmentRequest.

php artisan make:command ResendFailedInvoices writes a class to app/Console/Commands, which Laravel registers automatically. Its #[Signature] attribute names the command and declares input, #[Description] feeds the listing, and handle() does the work with container-injected services.

Laravel Pint is an opinionated PHP code style fixer built on PHP CS Fixer and shipped as a dev dependency of new Laravel apps. Running ./vendor/bin/pint rewrites your PHP files to the laravel preset; adding --test only reports.

Laravel Sail is a bash script plus a generated compose.yaml that runs the app and its services in Docker. In Laravel 13 you run composer require laravel/sail --dev, then php artisan sail:install, then ./vendor/bin/sail up.

$request->validate($rules) returns an array of just the validated fields. On failure it throws ValidationException, which becomes a redirect back with flashed errors and old input, or a 422 JSON response when the request expects JSON; the rest of the action never runs.

A failed form validation redirects back and flashes the errors to the session; ShareErrorsFromSession in the web group shares them with every view as $errors, a ViewErrorBag. Read them with @error('field') and $message, or first(), has() and all().

A form request is a class extending Illuminate\Foundation\Http\FormRequest that carries authorize() and rules(). When the container resolves it for a type-hinted controller parameter, it authorizes and validates first; the action body runs only if both pass.

Validator::make($data, $rules) validates any array and does nothing on failure until you ask. fails() returns a boolean and fills errors(); validate() throws ValidationException or returns the validated array; validated() returns the validated data and also throws if invalid.

Pass inline messages and attribute names (a form request's messages() and attributes(), or the extra validator arguments) or put them in lang/{locale}/validation.php under custom and attributes. Inline entries win, then custom, then the rule's default line.

@csrf renders a hidden _token input holding the session's CSRF token. In Laravel 13, PreventRequestForgery lets same-origin browser requests through by Sec-Fetch-Site; otherwise a missing or stale token throws TokenMismatchException, rendered as 419 Page Expired.

APP_KEY is the secret the Laravel encrypter, encrypted cookies and signed URLs use. key:generate writes a random key (32 bytes for the default cipher), base64-encoded behind a base64: prefix, into .env; with no key, resolving the encrypter throws MissingAppKeyException.

Hash::make() turns a password into a one-way, salted bcrypt or Argon2 hash that you store; Hash::check() re-hashes the attempt and compares, returning true or false. Crypt is reversible, so anyone with APP_KEY could read every password.

Routes in routes/web.php run PreventRequestForgery, and a server-to-server webhook sends neither Sec-Fetch-Site nor a CSRF token, so it gets 419. Exempt the URI with preventRequestForgery(except:) or move the route outside the web group, then verify the provider's signature.

Set a new APP_KEY and list the leaked one in APP_PREVIOUS_KEYS so sessions, stored ciphertext and signed links keep working. New values use the new key, but anything forged with the leaked key still verifies until you re-encrypt data and remove it.

A gate is a named closure registered with Gate::define for one-off checks not tied to a model. A policy is a class grouping one model's abilities (view, update, delete), found from the model you pass; most model rules belong there.

A guard decides how a request is authenticated and remembered; a user provider decides where user records are loaded from. The Laravel 13 skeleton ships one web guard (session driver) pointing at one users provider (eloquent, App\Models\User).

Auth::attempt($credentials) finds the user by the non-password keys, checks the password hash and, on success, signs them into the session, returning true or false. Regenerating the session ID defeats session fixation; Laravel 13's guard already does it in login().

App\Models\User must implement Illuminate\Contracts\Auth\MustVerifyEmail, users needs an email_verified_at column, sign-up must dispatch Registered, the verification.notice, verification.verify and verification.send routes must exist, and routes use ['auth', 'verified'].

Sanctum offers cookie-based session authentication for a first-party SPA on a stateful domain, and database-backed personal access tokens sent as a Bearer header for mobile apps and scripts. Your own SPA uses the session; the mobile app uses a token.

With APP_DEBUG=true an unhandled error renders Laravel's detailed exception page: stack frames with source code, request headers and body, route details and executed SQL. On a public site that hands attackers secrets and internals, so production keeps it false.

dump() prints its arguments and lets the request continue; dd() prints them and stops execution. Log::debug() writes to the log instead of the output, so it suits queued jobs, JSON endpoints and anything whose output you cannot see.

Create resources/views/errors/404.blade.php (any status code works); Laravel renders it for an HTTP exception with that status and passes it as $exception. 4xx.blade.php and 5xx.blade.php only cover statuses with no specific page, yours or the framework's.

report($e) passes a Throwable to Laravel's exception handler, which applies its filters, throttling, callbacks and default logging, then returns so your code carries on. Call it in a catch block when a failure must be recorded without failing the request.

LOG_CHANNEL picks the default channel (stack), LOG_STACK lists the channels that stack writes to (single), and LOG_LEVEL is the minimum level for channels that read it (debug). So Log::info() lands in storage/logs/laravel.log.

The default is the locale key in config/app.php, read from APP_LOCALE and defaulting to en. App::setLocale('es') switches it for the rest of the current request; App::currentLocale() and App::isLocale('es') read it back.

Create lang/{locale}/messages.php returning a keyed array and call __('messages.welcome'). If neither the current nor the fallback locale has that line, __() returns the key string itself instead of throwing.

Write a middleware that takes $request->user()?->locale when it is supported, else $request->getPreferredLanguage($supported), and calls App::setLocale(). Append it to the web group so it runs after the session starts and the employee is known.

Use lang/es.json, keyed by the original sentence, for many UI strings; use PHP group files for stable short keys and nested arrays. __() checks the locale's JSON file first, then parses the key as group.item.

Pass an array as the second argument, __('messages.thanks', ['name' => 'ana']). Laravel replaces :name as given, :Name with the first letter uppercased and :NAME fully uppercased; a placeholder with no value stays in the output literally.

Bus::chain runs jobs one after another, each only if the previous one succeeded, and stops at the first failure. Bus::batch pushes all jobs at once to run in parallel, records progress in job_batches and fires then, catch and finally callbacks.

Run php artisan make:job to get a class in app/Jobs that implements ShouldQueue and uses the Queueable trait, then call YourJob::dispatch($args). The job is serialized onto the default connection (database in a new app) and a queue:work process later calls handle().

php artisan queue:failed lists failed_jobs, queue:retry <id> or all pushes the stored payload back onto its original queue, queue:forget <id> deletes one record, queue:flush deletes all, and queue:prune-failed removes old ones.

queue:work boots the app once and runs jobs in one long-lived process: fast, but blind to new code until restarted. queue:listen spawns a fresh queue:work --once per job: current code, much slower. Production runs queue:work.

The job can reach a worker before the transaction commits, so the worker cannot see the new user and SerializesModels throws ModelNotFoundException. afterCommit holds the push until every open transaction commits, and drops the job on rollback.

Tasks are registered with the Schedule facade in routes/console.php, or through withSchedule in bootstrap/app.php. One server cron entry runs php artisan schedule:run every minute, and that command runs whichever tasks are due in that minute.

Schedule::command and Schedule::exec start a child process from schedule:run; Schedule::call runs a closure inside the schedule:run process; Schedule::job dispatches the job, so a ShouldQueue job runs later on a queue worker, while a non-queued one runs inline.

withoutOverlapping() makes the scheduler take a cache lock before running a task and skip the task while that lock exists, so a slow run is not joined by a second copy. The lock expires after 1440 minutes unless you pass another value.

Each server's cron runs schedule:run, and each sees the same task due, so it runs once per server. onOneServer() makes each server try a lock in a shared cache keyed by task and minute; only the winner runs it.

No: schedule:run runs due tasks one after another, in the order they are defined. runInBackground() starts a command or exec task as a detached process and moves on at once; closures cannot use it.

Run php artisan install:broadcasting, implement ShouldBroadcast on the event with a broadcastOn() returning its channels, dispatch it as usual with a queue worker running, and subscribe in the browser with Echo's channel()->listen() or a useEcho hook.

Run make:event OrderPlaced and make:listener ReserveInventory --event=OrderPlaced. Laravel 13 discovers listeners in app/Listeners and registers each handle* or __invoke method for the event class type-hinted on its first parameter; Event::listen registers one by hand.

A mailable, generated by make:mail, splits one email into envelope() for subject and sender metadata, content() for the Blade or Markdown view, and attachments() for files; Mail::to($customer)->send(new OrderConfirmed($order)) delivers it.

A notification, made with make:notification, is one message with a format per channel: via() returns the channel names for each recipient, and toMail(), toDatabase() or toVonage() build each version. Send it with $user->notify(...) or Notification::send($users, ...).

Reverb is Laravel's first-party WebSocket server, run as a long-lived php artisan reverb:start process. It implements the Pusher protocol, so Laravel broadcasts to it through the Pusher driver and browsers connect with Echo and pusher-js, identified by REVERB_APP_KEY.

The public disk is a local-driver disk rooted at storage/app/public for files meant to be web-visible. The web server only serves the public/ directory, so php artisan storage:link creates a public/storage symlink that exposes that folder.

put(), delete(), copy() and move() return true or false; get() returns the contents or null; exists() returns a boolean. With a disk's throw option true, failures raise League\Flysystem exceptions such as UnableToWriteFile instead of returning false or null.

Storage calls without disk() go to the default disk, config filesystems.default, read from FILESYSTEM_DISK and falling back to local. Storage::disk('s3') picks a named disk. Moving to S3 needs the Flysystem S3 package, AWS credentials and bucket settings.

Storage::url() builds a permanent, unsigned link that works only for publicly readable files. Storage::temporaryUrl($path, now()->addMinutes(10)) builds a signed link that expires, which suits private medical documents once the user has been authorized.

AWS_ENDPOINT feeds the s3 disk's endpoint key, sending API calls to another S3-compatible host. AWS_USE_PATH_STYLE_ENDPOINT puts the bucket in the URL path instead of the hostname. AWS_URL sets the base URL Laravel uses for public file links.

RefreshDatabase runs migrate:fresh the first time a test in the process needs it, then wraps every test in a database transaction that is rolled back afterwards. Each test starts from the same clean schema without paying for a migration per test.

Call $this->get() or $this->post() inside a Tests\TestCase test; each returns a TestResponse. Chain assertOk() or assertStatus(), assertRedirect() or assertRedirectToRoute(), and assertViewIs() or assertViewHas() for the Blade data.

Feature tests extend Tests\TestCase, which boots the whole Laravel application before every test, so HTTP calls, the database, facades and the container work. The skeleton's unit tests extend PHPUnit\Framework\TestCase directly and boot nothing.

Call Queue::fake() (or Bus::fake()) and Mail::fake() before the request, then assert with Queue::assertPushed(ProcessRefund::class) and Mail::assertSent(RefundIssued::class). The fakes record instead of pushing or delivering, so neither the job nor the mail runs.

actingAs($user) puts the user straight onto a guard and makes it the default for the rest of the test, skipping credentials, session login and the Login event. Use it for what sits behind login; test login itself through the login route.

collect() wraps an array or iterable in an Illuminate\Support\Collection. map() and filter() each return a new Collection and leave the original untouched, which is what makes long chains safe to write.

No. Laravel's Http client returns a Response for 4xx and 5xx statuses; check successful() or failed(), or call throw() to raise RequestException. Timeouts and refused connections are different: they always throw ConnectionException.

A Collection holds every item in a PHP array; a LazyCollection holds a source, usually a generator function, and pulls items one at a time only when enumerated. Use it when the data is too big for memory.

Process::run() returns an Illuminate\Process\ProcessResult whatever the exit code: failed() is true and exitCode() holds the code. Chain throw() to raise ProcessFailedException. Running past the 60-second default timeout always throws ProcessTimedOutException.

now() returns a Carbon instance for the current moment and today() one for midnight today, both created through the Date facade. $order->created_at->diffForHumans() renders a past date relative to now, such as '3 days ago'.

Fetch the code, run composer install --no-dev, build front-end assets, run php artisan migrate --force, run php artisan optimize, then php artisan reload. --no-dev skips require-dev packages; --force skips migrate's production confirmation, which a non-interactive script would otherwise cancel.

Laravel Cloud runs the app for you on fully managed, auto-scaling compute with managed databases, caches and object storage; Forge provisions and manages servers you own on a provider; Vapor deploys the app serverless onto AWS Lambda.

php artisan down makes Laravel answer requests with a 503 maintenance response. With --secret=token (or a random --with-secret), visiting /token sets a signed laravel_maintenance bypass cookie so that browser uses the site normally; php artisan up ends maintenance.

php artisan optimize runs config:cache, event:cache, route:cache and view:cache, plus any commands packages register. php artisan optimize:clear runs the matching :clear commands, and it also runs cache:clear and clear-compiled.

Pulse registers a default viewPulse gate that only passes in the local environment, and its Authorize middleware checks that gate on /pulse, so production answers 403. Define viewPulse yourself in AppServiceProvider::boot, for example allowing only admins.

Laravel Cashier wraps Stripe's billing API for an Eloquent model. The Billable trait adds customer columns, a subscriptions relation and methods such as newSubscription(), subscribed(), checkout(), charge() and invoices(), while Stripe remains the system that actually bills customers.

Feature::define('new-checkout', fn (User $user) => ...) registers a resolver, usually in AppServiceProvider::boot(). Feature::active('new-checkout') checks it for the default scope, the authenticated user, and Feature::for($scope) checks another user, team or value.

The Searchable trait registers a Scout model observer that upserts the record into the search index on every Eloquent save and removes it on delete, using toSearchableArray() as the document and searchableAs() as the index name.

newSubscription('default', $priceId) returns a SubscriptionBuilder whose checkout() creates a Stripe Checkout session and redirects there. The local subscriptions row is written later, when Cashier's webhook handler receives customer.subscription.created, not when the customer returns to success_url.

swap() moves to new prices, prorating by default. cancel() sets ends_at to the period end, leaving a grace period; cancelNow() ends it at once; resume() works only inside the grace period. onTrial() and onGracePeriod() compare trial_ends_at and ends_at with now.