Nova Link Field Laravel Package

Product Decisions This Supports

• Scoping the admin-experience backlog against customer-facing work. This package is a single-purpose presentational field: it renders an existing string column as a clickable <a href> in Nova's index and detail views. It does not add storage, sync, or business logic. The decision it informs is narrow — "do we spend effort making operator screens nicer this sprint, or not?" — and it should be prioritized against other internal-tooling items, not against customer features.
• A build-vs-buy call whose honest answer is build. The real scope is a small PHP Field subclass plus a Vue component that renders an anchor, roughly 60–120 lines. With 22 stars, zero dependents, and no release since February 2020, "adopt the package" actually means "vendor someone else's 2020-era code and own it forever." Frame the choice as half a day writing a first-party field vs. copying ~100 lines into our repo — not as add a dependency. That reframing is the decision, and it's a cheap one either way.
• Making the integration seam visible to operators. Where a Nova resource mirrors a record whose canonical home is elsewhere — a storefront page, a DAM asset, a ticketing record, an upstream CMS entry — a link field is the cheapest way to surface "where this thing actually lives" without building or maintaining a sync. That has real value in admin panels where staff routinely context-switch out of the tool to verify something.
• Operational throughput, if measured narrowly. For support and content-ops, the metric worth tracking is clicks and seconds between "I found the record" and "I verified the external artifact." A link field shortens that loop. It's worth doing opportunistically when the team is already touching that resource; it is not worth standing up a project around.
• Roadmap weight: treat as near zero. No customer-facing capability, no revenue or retention impact, no strategic differentiation. Inflating it into a feature commitment invites disproportionate scrutiny and review cycles for what is fundamentally a half-day of internal polish.
• Where not to spend. Do not extend it toward multi-link, link-with-metadata, redirect resolution, or link-health monitoring. Those are different products; this field is single-value by design, and bolting arrays onto it means rewriting the Vue component anyway.

When to Consider This Package

Consider it when all of the following hold:

• You are on Laravel Nova 3 or earlier. The last release predates Nova 4's Vue 3 frontend rework. Assume incompatibility with Nova 4/5 until your own team verifies it on your own stack — not on a demo or an old install.
• You need display-only behavior. The column stays a plain string; the field only changes how Nova presents it. Pair it with a normal Text field for editing (onlyOnForms() / exceptOnForms()) so operators still get a plain input box when pasting URLs.
• The blast radius is genuinely internal. Admin-panel-only rendering, with data entered by trusted staff or curated internally.
• You accept owning the code. Given the maintenance profile, the recommended integration is fork-and-vendor: clone the source into your namespace or scaffold a first-party Nova field and port the behavior, so it lives under your CI, your code review, and your dependency audit.
• You can fund the small hardening pass. Two things a 2020-era field routinely gets wrong and you should fix on day one: enforce a scheme allowlist (http, https, mailto) on save, and render with an escaped :href binding plus rel="noopener noreferrer" whenever target="_blank".

Look elsewhere — or skip it — when:

• You're on Nova 4/5. A clean Composer install followed by a silently blank column is worse than a hard failure. Read src/Link.php and the two .vue files as a specification and reimplement; you'll get the same behavior with no dead dependency.
• You need anything beyond a clickable link. URL validation on the field itself, redirect following, link-health checks, link previews, or multiple links per record are all out of scope and should be specced separately.
• The value is speculative. If nobody on the ops or support team is currently complaining about copy-pasting URLs out of the admin panel, you're buying polish nobody asked for. The failure mode is also silent (a blank column, not an error), so unowned adoption drifts into your manifest as an unmaintained package with a five-year gap — a bad conversation to have at audit time.
• It would arrive as a transitive or casual dependency. With zero dependents, nobody has validated this against a Nova upgrade. You'd be the first.

How to Pitch It (Stakeholders)

To executives (60 seconds): This is a small internal admin-panel polish item, not a product feature. It makes URLs stored in our database clickable inside our admin tool, so support and content staff can jump to the external record instead of copying and pasting it. Cost is roughly half a day of engineering. There is no customer-facing change, no revenue impact, and no new vendor relationship we need to manage — the package itself is unmaintained, so we'd copy the code into our own repo rather than depend on it. Recommended: fold it into existing admin work if we're already in that area; otherwise defer. It's a "yes, cheap" or "yes, later," never a roadmap line.

To engineering (the framing that gets a clean build): Don't composer require this on a modern stack. The last release is February 2020 — Nova 2/3, Vue 2, Laravel Mix era — and there are zero dependents, meaning nobody has tested it against a Nova upgrade. Two viable paths, both under a day:

1. Clone into our namespace (app/Nova/Fields/Link) and use it as a starting point, adding a scheme allowlist, rel="noopener noreferrer", and a feature test asserting hostile input (javascript:, data:, quote-breaking payloads) is escaped.
2. Scaffold a first-party field (php artisan nova:field acme/link) and port the behavior from the source. Roughly 60–120 lines; we own upgrades in one place.

Either way: read src/Link.php before trusting any README snippet (setter names like text(), target(), openInNewTab() vary), confirm dist/js/field.js is committed, and roll out one resource at a time — the break mode is a silently blank column, so staging-check each resource before widening.

The one-line risk statement: a link field is a textbook stored-XSS surface in an admin panel. Treat the href as hostile input even when the data is "obviously" internal — validate the scheme on save, bind with :href (never v-html), and add rel="noopener noreferrer" on every outbound link. That's a small, one-time hardening cost we should budget into the same half-day.