Nova Collapsible Sidebar Laravel Package

Technical Evaluation

Architecture fit. This is a presentation-layer asset injection into Laravel Nova's admin SPA — a service provider that publishes a small JS/CSS bundle over Nova's default navigation. It touches no database, queue, API surface, or auth path, so in shape it fits a Laravel/Nova stack cleanly. The fit problem is durability, not architecture: it binds to Nova's front-end internals (DOM structure, Vue component boundaries, CSS class names), which are not a published contract. That is a coupling to a private API owned by a paid third party.

Integration feasibility. Composer install with auto-discovery, vendor:publish, done. Effort for a spike is measured in hours. Confidence that it works is another matter: the last release is October 2018, which predates Nova 2, 3, and 4 (Vue 3, Inertia, Tailwind, reworked nav). The install will succeed; whether it produces a working toggle is unknown until we test against our exact Nova version.

Technical risk.

• Version coupling. Nova's front end changes between majors. A 2018 selector-based patch is the most fragile class of dependency in a Nova app.
• Licensing gap. No license file is evidenced in the materials. Default copyright applies — all rights reserved. Legal must clear this before we vendor or fork, and vendoring is the only sane deployment model here.
• Maintainership. 32 stars, one maintainer, no test suite, no release activity in ~7 years. Assume zero upstream support.
• Global keyboard handler. The toggleKeyCode mechanism is a document-level key listener. It can collide with form inputs, browser shortcuts, or a command palette, and it has accessibility implications (icon-only nav needs names, focus states, and screen-reader semantics — not visible in the description).
• Persistence semantics. "Remembers each user's state" is almost certainly client-side storage, i.e. per-browser-profile, not per-account. It won't follow a user across devices, is invisible to admins, and generates "it keeps resetting" tickets on shared machines and in incognito.
• Silent failure mode. A broken selector or JS exception degrades the primary navigation of the admin panel — the highest-consequence screen we run, even if the audience is internal.

Key questions.

1. Does our current Nova version already ship collapsible nav natively, or via an official first-party tool?
2. What was the actual toggleKeyCode defect in 0.1.2 — a key collision, or a toggle that silently failed to revert state?
3. Is there a license, and does it permit forking and internal redistribution?
4. Does it survive a Nova major upgrade without editing files under vendor/?
5. Does icon-only navigation meet our accessibility bar, and who signs off?
6. Who owns the fork when it breaks — named engineer, not "the team"?

Integration Approach

Stack fit. Laravel/Nova, yes. But my recommendation on this specific capability is build, don't buy. A collapsible sidebar is roughly 50–150 lines: a CSS custom property toggling a nav width, one storage key, and a Nova::script() / Nova::style() registration (or a Nova custom tool). That is cheaper than the review overhead of adopting an unlicensed, seven-year-dormant dependency, and it is owned in-repo. The package's real value to us is as a reference implementation — read it, then reimplement.

Migration path. Two-phase.

• Phase 0 — spike (1–2 days). Install pinned 0.1.2 in a staging instance on our exact Nova version. Verify: collapse/expand, state persistence across reload and session, keyboard toggle inside and outside form fields, no console errors across our top ten resource screens, and no layout regression in tables and dashboards. Hard decision gate at the end.
• Phase 1 — productionize. If the spike passes, fork into a private VCS or packages/ and pin the exact tag. If it fails, reimplement natively using the fork as documentation. Either way the production artifact is ours.

Compatibility. Pin 0.1.2 exactly; commit composer.lock; record the validated Nova version in the repo. Gate Nova major upgrades on a re-run of the spike checklist. Do not accept a floating constraint on a 0.1.x package.

Sequencing. (1) Confirm Nova version and whether native capability exists — this may end the evaluation immediately. (2) License clearance from legal. (3) Staging spike. (4) Accessibility review of icon-only nav and the key handler. (5) Fork/own the code behind a config-driven kill switch. (6) Ship to admin users only; no customer-facing surface.

Operational Impact

Maintenance. Effectively zero upstream maintenance — assume we own it from day one. Budget 1–2 engineer-days per year, concentrated at Nova upgrades. The forking cost is trivial precisely because the surface is tiny; that is this package's one genuine advantage over rolling our own, and also the reason rolling our own is cheap.

Support. Two ticket classes will appear: "the sidebar won't stay collapsed" (storage cleared, incognito, new browser, different device — because persistence is per-browser, not per-user) and "the shortcut eats my keystrokes" while typing in a form. Neither is severe; both are confusing without documentation. Write a short internal runbook covering the shortcut, the per-browser scope, and the "clear local storage" fix.

Scaling. No server impact. Pure static assets, no request-path cost, no DB, no cache. This dimension is a non-issue and should not consume evaluation time.

Failure modes.

• JS exception → degraded or broken admin navigation. Highest severity; mitigate with a config kill switch so we can disable without a deploy.
• CSS selector drift after a Nova upgrade → a collapsed sidebar that cannot be expanded. Worst case, users lose nav access. Same mitigation, plus the runbook.
• Key handler consuming input in form fields — silent data-quality risk for admins and support staff.
• CSP blocking if we hand-roll the script without nonce handling — a self-inflicted version of the same failure, and one we can design around.

Blast radius is internal admin users only. That is what makes a pilot defensible; it is also the ceiling on how much this deserves.

Ramp-up. Low for any Laravel developer — an hour to read. The real cost is inverted: nobody on the team understands the internals until it breaks, and at this maturity the source is the documentation. Forks with no tests and no changelog history are exactly the codebases that get orphaned inside an organization.

Recommendation: conditional, weighted toward reimplementation. Run the single-day spike to confirm what our Nova version already does natively. Absent a native equivalent, build the toggle in-house from this package as a reference. If we do adopt, the conditions are non-negotiable: license cleared, exact version pinned, code forked and owned, config kill switch, accessibility sign-off, and a stated exit criterion — either a Nova major upgrade or a native feature retires the dependency.