Filament Curator Laravel Package

Product Decisions This Supports

• Build vs. buy for media management. The core question this package answers is whether a media library is a differentiator or commodity plumbing. If the roadmap is "editors upload images to a Filament admin and attach them to records," Curator covers upload, crop, edit, search-and-select, reusable library, responsive output, and rich-text insertion out of the box. That is weeks of engineering and a perpetually under-prioritized backlog item you can delete from the roadmap.
• Admin/editorial self-service. The CuratorPicker field plus the central library means content teams stop filing tickets for image swaps, crops, and focal points (curations). This is a support-cost decision, not just a technical one — it shifts work from engineering to content ops.
• Performance and delivery budget. Signed Glide URLs, <x-curator-glider> with srcset/sizes, and curation presets (WebP, quality, dimensions) let you make a defensible Core Web Vitals commitment without building an image-transformation service. Decide now whether image optimization is in scope for the release; retrofitting responsive images later is expensive.
• Ecosystem standardization. Adopting it is effectively a statement that the admin surface is Filament-native. Coupled with Filament 4.x/5.x support, this reinforces a "buy the admin layer, build the domain" strategy — worth stating explicitly to avoid re-litigating it per feature.
• Security and compliance posture for uploads. The package ships a sensible default allow list (excluding HTML/XML/JS/PHP/SVG-script vectors), nosniff, forced Content-Disposition: attachment for restricted types, and SVG sanitization only. This supports a decision to accept user-supplied media with a documented residual risk, provided you opt private disks for anything exotic. If compliance requires AV scanning, DLP, or per-asset retention policy, that gap is yours to fill.
• The one architectural decision that is hard to reverse: it is explicitly incompatible with Spatie Media Library. If any model already uses Spatie, or if the product roadmap implies Spatie's conversion/collection model, choosing Curator is a migration decision, not a plugin install. Surface this as an ADR, not a code review comment.
• Operational risk acceptance. Single-maintainer package, 440 stars, zero dependents listed, MIT. This supports a "vendor with a fork contingency" decision — budget a few days a quarter for Filament major-version catch-up and be prepared to own the package if it goes stale.

When to Consider This Package

Adopt when:

• The admin is (or will be) Filament 4.x/5.x, and image management is a supporting feature rather than a product pillar.
• You are greenfield on media — no Spatie Media Library, no legacy assets table you'd have to backfill.
• The need is images for editorial content: hero images, galleries, product photos, rich-text inline media, with crop/focal-point control in the hands of non-engineers.
• You want signed-URL delivery and responsive variants without standing up imgproxy/Cloudinary or writing your own Glide wrapper.
• You can absorb the two setup chores: a custom Filament theme build (CSS @import + @source for the plugin views) and adding CURATOR_GLIDE_TOKEN to .env.example and every deployment target.
• Team size is small enough that a single-maintainer dependency is an acceptable bet, and you're willing to pin versions and test upgrades.

Look elsewhere (or build) when:

• Spatie Media Library is already in production. Migration cost and lost capabilities will dominate the savings.
• You need a true DAM: asset versioning, rights/licensing metadata, approval workflows, usage tracking across many entities, large vocabularies of tags, non-image documents with retention rules.
• Media must be shared across multiple applications, or uploaded by end users/public APIs rather than admins — this is an admin-panel plugin, not a media service.
• You require video/audio transcoding, large-file/chunked uploads, or CDN-level transformation.
• Procurement demands an SLA, CVE response commitments, or a support contract. MIT + one maintainer does not satisfy that.
• You need multi-tenant isolation with per-tenant storage policies beyond what tenantAware and path generators give you.
• The team cannot take a dependency on Filament's release cadence (the 1.x→5.x compatibility table shows every Filament major forces a Curator major).

How to Pitch It (Stakeholders)

To executives: We can ship image management — upload, crop, reusable library, responsive/signed delivery — as a plugin install rather than a build. It's MIT licensed, so there's no licence cost, and it removes a feature that otherwise sits in the backlog indefinitely. The trade-offs are honest and small: a few days of setup (theme build, per-environment signing token), and a maintenance line item for keeping pace with Filament upgrades. The one decision I need from you is strategic: we are committing to a Filament-native admin and explicitly not to Spatie Media Library. If we ever want to reverse that, it costs a migration — so I'd rather we agree now than discover it in six months.

To engineering: Treat this as purchased plumbing with two operational sharp edges we must handle deliberately. First, the Glide token: it's per-environment, must exist in .env.example and every deploy (CI, staging, prod), and rotating it 403s every previously signed URL — cached HTML, CDN copies, sent emails. That needs a runbook and a "don't rotate casually" note, plus config:clear after any change. Second, upload security: the default MIME allow list is genuinely well-reasoned, and the package only sanitizes SVG. If product ever asks to allow HTML/XML or other opt-in types, the answer is a private disk, not a config tweak — the public storage symlink bypasses the protective headers. Also budget for: relationship columns need eager loading (modifyQueryUsing(fn ($q) => $q->with(...))) or you get N+1s, and we should pin the version and own the Filament major-upgrade testing. Finally, accept the bus-factor risk explicitly: worst case, we fork and maintain — which is a day or two a quarter, not a rewrite.