Filament Themer Luncher Laravel Package

Technical Evaluation

• Architecture fit: Filament Themer Luncher is an admin control center layered over Laravel Themer 1.4, exposing theme health, diagnostics, metadata, and install/activation workflows through Filament. It fits Laravel applications that already use Filament for back-office operations and want theme management without CLI-only workflows. The package is additive: it does not replace Laravel Themer but hardens and surfaces its capabilities.
• Integration feasibility: Requires Laravel Themer ^1.4, PHP 8.3–8.5, and a Filament admin panel (Filament version not stated in notes — verify). CI coverage for Laravel 12/13 suggests forward compatibility. Installation is Composer-based; configuration likely needed for allowlists and backup-before-activate. Feasible for teams already on the required stack; less suitable for legacy PHP/Laravel applications.
• Technical risk: Security hardening reduces but does not eliminate risk from remote/Git/ZIP installs. New allowlists for URL hosts and local paths are optional, so default posture may remain permissive unless configured. ZIP traversal protections and safe Git process arguments are positive. Dependency on Laravel Themer API stability is a medium risk. Activation/preview compatibility fixes indicate prior edge-case fragility. Filament version compatibility and multi-tenant behavior remain open questions.
• Key questions: Which Filament major versions are supported? Are URL/local path allowlists enabled by default or opt-in? Where are backups stored, how are they retained, and can they be restored from the UI? Does the package support multi-site or multi-tenant theme assignments? What is the upgrade path from earlier Luncher versions? How does theme:refresh fallback behave when unavailable? Are health badges computed on page load or cached?

Integration Approach

• Stack fit: Strong fit for Laravel 12/13 + Filament + Laravel Themer 1.4 environments where non-technical admins need to inspect theme health, preview themes, and perform safe installs. Poor fit for non-Filament admin stacks or teams unwilling to grant UI-driven install capabilities.
• Migration path: For new adoption, install in staging, publish config, enable allowlists and backup-before-activate before testing remote/Git/ZIP flows. For upgrades from a prior Luncher version, review config changes for allowlists, backup behavior, and cache refresh fallback; re-run diagnostics after upgrade. No database migration is mentioned, lowering migration risk.
• Compatibility: Confirmed CI coverage for Laravel 12/13 and PHP 8.3–8.5. Laravel 11 is intentionally excluded due to Composer security advisories. Laravel Themer ^1.4 is required. Filament compatibility must be confirmed against the project’s Filament version. Preview commands require --expires, matching Themer 1.4.
• Sequencing: (1) Confirm Filament and Laravel Themer versions. (2) Install in staging with allowlists configured. (3) Validate health badges and diagnostic actions against representative themes. (4) Test remote, Git, and ZIP installs using allowlisted sources only. (5) Enable backup-before-activate and test restoration. (6) Train admins on Theme Doctor, Status Report, Debug JSON, and Explain Theme actions. (7) Roll out to production with monitoring.

Operational Impact

• Maintenance: Active release cadence with CI, Pest, Pint, PHPStan, and Composer validation. Maintenance burden includes monitoring Laravel Themer 1.4 updates, Filament compatibility, and allowlist/backup configuration drift. The added Boost guidance and documentation reduce onboarding friction but require periodic review.
• Support: New diagnostics actions improve first-line support by exposing theme health and metadata in the UI. Security documentation and upgrade docs are positive. Support teams will need training on interpreting health badges (healthy, dependency review, conflicts, broken parent) and on safe install workflows. Remote install failures will still require platform-level troubleshooting.
• Scaling: UI actions such as Theme Doctor and Status Report may be expensive if many themes are present; health badge computation should be monitored for admin-page latency. Remote/Git/ZIP installs are inherently heavier and should be restricted to allowlisted sources. Backup-before-activate adds storage overhead; plan retention and cleanup.
• Failure modes: Remote URL timeouts or invalid responses; Git process failures despite safe argument handling; ZIP extraction blocked by traversal protection (expected but may confuse users); activation with empty/deactivation-style calls (fixed but worth regression testing); preview command expiration mismatch (fixed for Themer 1.4); backup failure during activation if enabled; stale cache when theme:refresh is unavailable. Allowlist misconfiguration can block legitimate installs.
• Ramp-up: Filament-familiar admins can adopt the UI quickly. Theme concepts (requires, conflicts, provides, design tokens) require some learning. Security configuration (allowlists, backups) needs deliberate setup and documentation review. Expect low-to-moderate ramp-up for existing Laravel/Filament teams and higher for teams new to Laravel Themer.