Statamic Auto Alt Text Laravel Package

Getting Started

Start by checking your Prism version, not this package's version. This package is an extension of prism-php/prism, and the headline fix in 2.0.5 is purely a Composer constraint issue:

composer show prism-php/prism | grep versions
composer why prism-php/prism

If your app (or another dependency) requires Prism 0.100 and you are on this package 2.0.4 or lower, installation will fail with a resolver conflict — ^0.99 does not mean "0.99 or newer" on a 0.x package, it means >=0.99.0 <0.100.0. Upgrading this package to 2.0.5 is the fix, not loosening your own constraint.

Then:

composer require <vendor>/<package>:^2.0
php artisan vendor:publish --provider="<Vendor>\<Package>\<Package>ServiceProvider"

Set any required credentials in .env (this package sits on top of Prism, so your provider keys are normally the ones Prism already expects — check whether it introduces its own config keys before adding duplicates).

Where to look first, in order:

1. README.md — the install + first-request example.
2. The published config file — this is where the Prism driver/model defaults and any package-specific toggles live.
3. The service provider — it tells you what gets bound into the container and, critically, where this package hooks into Prism's request chain.
4. tests/ — 2.0.5 added a test covering the Prism request chain; read it before writing your own integration, it is the fastest documentation of the intended wiring.

First use case: take the simplest single, non-streaming Prism call your app already makes and route it through this package. Confirm the response is unchanged before you enable any of the package's added behaviour. Getting a clean baseline on one request is worth more than wiring up the full feature set and debugging two variables at once.

Implementation Patterns

Treat it as a decorator on Prism's lifecycle, not a replacement. The package's value is in what it does around the Prism request — logging, transformation, tooling, observability, whatever the chain hook provides. Keep your existing Prism:: calls and let the package observe them, rather than rewriting call sites to a package-specific API. That keeps you upgradable when Prism itself moves.

Match the maintainer's constraint strategy in your own composer.json. 2.0.5 exists because a caret on 0.x pins the minor. For any Prism-adjacent dependency in your app, prefer an explicit range ("prism-php/prism": ">=0.99 <0.101") or the widen Dependabot strategy the maintainer just adopted, so the next Prism minor arrives as a PR that widens the range instead of silently blocking installation.

Mirror the CI matrix. The release notes say CI now runs against every supported Prism minor. Do the same in your app's pipeline if you depend on both — a small matrix job on the lowest and highest supported Prism version catches exactly the class of bug 2.0.5 fixed. Locally, composer update --prefer-lowest --prefer-stable on a throwaway branch is a cheap approximation.

Keep it off the request path. Anything that wraps an LLM call adds latency and a failure mode. If the package supports queueing or deferring its work, use it from a job rather than a controller. A slow provider should degrade your feature, not your page.

Test against fakes, not the network. Prism ships fake/fixture support; use it so your suite exercises the request chain without API keys or flakiness. Assert on the outgoing request payload in at least one test — that is the layer where this package operates, and where regressions hide.

Version-pin deliberately during rollout. Bump this package and Prism together in one PR, run the suite, then separate them. Two independent 0.x bumps in the same deploy make bisecting a failure painful.

Gotchas and Tips

• The 0.x caret trap is the whole story of this release. ^0.99 = >=0.99.0 <0.100.0. Any package you maintain that depends on a 0.x library should think hard before using ^. This applies to your own published packages, not just your apps.
• Lockfile skew between app and package. If your app pins Prism 0.100 and a transitive dependency still requires ^0.99, Composer reports a conflict naming the other package. Run composer why-not prism-php/prism 0.100 — it names the blocker directly instead of making you guess.
• If you were blocked from upgrading Prism, 2.0.5 unblocks you, and nothing else changed. No API changes in this release. Upgrade confidently, but re-run your integration test if you actually moved Prism from 0.99 to 0.100 at the same time — the risk is in Prism's diff, not this package's.
• The Dependabot fix is a warning for your own repos. The github-actions block had an unsupported cooldown option that silently disabled all version updates. Unsupported keys in Dependabot config do not always fail loudly — audit your configs for options that are accepted-but-ignored, and check that updates are actually arriving rather than assuming the bot is working.
• Debugging the chain. When behaviour differs from a bare Prism call, log the request before and after the package's hook rather than inside it. If responses are identical, the package is not in the chain at all — usually a provider registration or config-cache issue (php artisan config:clear after publishing).
• Extension points to prefer: published config, container bindings for the package's interfaces, and Prism's own event/listener hooks. Avoid subclassing internals of a 0.x dependency — the minor-version churn this release is managing means internals move.
• Watch the Prism minor releases, not this package's. Given a 0.x upstream and a maintainer actively widening ranges, the breaking-change risk in your stack comes from Prism. Subscribe to Prism's releases and read its changelog before bumping; treat this package's patches as the compatibility glue.