folklore/laravel-panneau
folklore/laravel-panneau provides a lightweight, configurable panel layer for Laravel applications, helping you build and organize admin screens, dashboards, and management interfaces with familiar conventions and minimal setup.
Architecture fit. The architectural category is unchanged from the alpha.1 assessment: Panneau v5 is the PHP reference implementation of the Panneau protocol plus a JavaScript client (@panneau/*), i.e. a headless admin backend rather than a Blade composition layer. alpha.4 refines the adoption shape rather than the category, and the refinement is in the right direction: Panneau::uploadRoutes() and Panneau::resourceRoutes($resources, only: [...]) let a host application mount a slice of the API instead of the whole admin, and route parameters are now read by name so tenants/{tenant}/... prefixes work. That converts Panneau from an all-or-nothing admin replacement into something that can sit beside an existing internal tool — a meaningful improvement for Inertia/SPA estates and for multi-tenant applications. Two new capabilities extend the data-access story rather than just the UI: global search (backed by repositories, or by Laravel Scout when a model uses it) and per-field slug checks (POST resources/{resource}/fields/{field}/check, with non-Eloquent repositories answering through ChecksSlugs). That means the package now defines not one but three read paths to reason about — repository, Scout index, and mediatheque — and the repository contract has grown an optional second capability. It remains in direct conceptual competition with Filament/Nova/Backpack.
Integration feasibility. Better than at alpha.1, on the same hard constraints (PHP 8.3+, Laravel 12 or 13, JS-capable frontend team). Concrete gains: partial route mounting lowers blast radius; name-based route parameters unblock tenant-prefixed deployments; Mediatheque::fake() makes media-testable code reachable in CI; the conformance kit still passes in full against panneau-js 5.0.0-alpha.5, including the two new endpoints, and the design intent is now traceable to published decision records (panneau-js 0030 search scope, 0032 field checks and slugs). That is unusually good discipline for an alpha. Offsetting it: media is only partially answered — file replacement arrives via a separate sibling package, folklore/laravel-mediatheque 2.0.0-alpha.5, so media is now a third pre-release dependency rather than a missing feature. Still absent: auth flows (password reset, 2FA, passkeys, OAuth), roles, export/import, pages/menus, and — still not mentioned in this release — a v4-to-v5 migration guide. v4 to v5 remains a re-implementation.
Technical risk. The package is still low-signal (2 stars, 0 dependents), and the provenance anomaly is not resolved by this release data; the future-dated metadata (2026-10-16) on the assessed release still needs an explanation before production use. Risks updated by alpha.4:
file field stopped being createOnly() (a behavior change for any existing media resource), replace() was added to permit type changes, and the search route shipped on by default (panneau.search.enabled is opt-out). Two of three are behavior changes an adopter would have to react to inside one alpha cycle.folklore/laravel-panneau + @panneau/* + folklore/laravel-mediatheque all on alpha channels, with a hard floor (mediatheque alpha.5+) for the replacement feature./api/search is behind the panneau-search limiter and scoped to resources the user can list — good design. resources/{resource}/fields/{field}/check is not stated to be rate-limited and is a form-liveness endpoint that answers "is this slug taken", which is an enumeration and a per-keystroke query-cost concern that must be authorized and throttled deliberately.@panneau/protocol under separate governance; policies are required and ETag/If-Match with 412 provides optimistic concurrency, but authorization misconfiguration now has JSON-API blast radius, extended to search scope and field checks.Key questions.
POST resources/{resource}/fields/{field}/check, and can it be used to enumerate unpublished or unauthorized slugs?panneau-search limiter tuned and overridden per application?resourceRoutes(only: [...]), what is the supported path to add resources later without a route/asset rebuild review?folklore/laravel-mediatheque required for non-media applications, and what is its stability and support policy?@panneau/protocol and how are spec breaking changes versioned?panneau:install modify in routes, middleware, and config in an existing app, and does it publish assets safely?TPM recommendation. Unchanged in verdict, better supported in evidence: treat v5 as a new product evaluation, not an upgrade, and do not adopt beyond a contained greenfield pilot. The engineering signals have improved again — full conformance against a named JS commit, published decision records, fake helpers, partial route mounting — but the release also demonstrates alpha churn (a createOnly() removal and a default-on endpoint in one cycle) and adds a third pre-release dependency. The pilot should now explicitly cover: search on and off, search authorization scope and limiter tuning, slug-check authorization and throttling, tenant-prefixed mounting, and media replacement against a pinned mediatheque alpha. Keep it behind a feature flag on a distinct route group, use partial route mounting to minimize blast radius, pin the documented PHP↔JS↔mediatheque triple, run the conformance kit in our own CI, and retain the documented fallback (plain Laravel JSON API plus our own UI). Do not plan a v4-to-v5 migration until the migration guide exists.
Stack fit. Best fit is unchanged: greenfield Laravel 12/13 on PHP 8.3+, internal admin surface, frontend team able to own @panneau/*. alpha.4 widens the acceptable envelope in two directions — an admin slice mounted into an existing internal tool via resourceRoutes(only: [...]), and multi-tenant applications whose routes carry a tenant parameter before the Panneau segment. Poor fit remains existing Laravel 10/11 estates, Blade-only teams without JS capacity, organizations already standardized on Filament/Nova/Backpack, and anything expecting authentication to come from the admin framework.
Migration path. Still no supported path from v4; nothing in alpha.4 changes that, so prior Panneau usage remains a separate system to retire or rebuild. The exit path is marginally better than at alpha.1: domain logic behind ResourceRepository is unchanged, Scout is optional so avoiding it keeps one fewer external contract in the exit cost, and the ChecksSlugs capability is an explicit, replaceable interface rather than hidden Eloquent behavior. Document the adapter boundary from day one: repositories, ResourceQuery-style filter/sort declarations, validation rules, and now field-check capability.
Compatibility. Verify the estate against PHP 8.3+/Laravel 12/13 first. Then pin explicitly per this release note, not by matching numbers: PHP ^5.0@alpha (alpha.4) with @panneau/* 5.0.0-alpha.5, plus folklore/laravel-mediatheque 2.0.0-alpha.5 or later if media replacement is in scope. Confirm the panneau-search rate limiter definition survives config caching and matches platform throttling conventions; confirm panneau.search.enabled default (on) is set explicitly in every environment config. Review the removal of createOnly() on MediathequeResource's file field and decide policy around replace() permitting type changes. Check Scout version compatibility if search will use it. Re-verify route parameter naming against any existing prefixed or localized route groups. Validate the Vite/Node toolchain against the JS alpha.5 client, and commit both lockfiles.
Sequencing.
php artisan panneau:install, define one resource end-to-end (repository, fields, list, slug, policy), exercise list/show/create/update/delete plus an If-Match conflict, then exercise the slug check endpoint and a global search with search both disabled and enabled.resourceRoutes(only: [...]) and uploadRoutes() mount cleanly beside an existing admin route group./api/search and fields/{field}/check before any shared-environment exposure.Maintenance. Burden is higher than at alpha.1 because the coupled surface grew: two alpha packages became three, and version numbers no longer align across PHP and JS, so pinning must be maintained as a documented triple rather than an assumed matching tag. Churn is no longer speculative — one alpha cycle produced a field-behavior change and a default-on endpoint. The contract tests and conformance kit remain the main mitigant: running them in our own CI turns upgrades from faith into a check. Expect to read both the Laravel package and the panneau-js decision records during upgrades, and budget asset rebuilds, dependency review, config review for search, and authorization regression tests on every bump.
Support. No commercial support path is evident and the community remains small (2 stars, 0 dependents). Diagnosability did improve: Mediatheque::fake() explains refusals so media failures are testable, and search/slug behavior is documented in numbered decision records rather than inferred from code. Escalation still means an internal engineer reading source across three repositories. Identify that person before rollout.
Scaling. The repository-and-ResourceQuery design still constrains the query surface well. New hotspots to budget for: global search fan-out across every listable resource's repository in a single request when Scout is absent; Scout index staleness and reindex cost when it is present; and POST .../fields/{field}/check as a form-liveness endpoint that can generate high request rates and repeated uniqueness queries per typed character — confirm client debouncing, server throttling, and indexed uniqueness lookups. Media replacement re-processes the original, so queue and CPU cost recur per replace. Existing concerns stand: N+1 on list endpoints, unbounded result sets, pagination defaults, definition payload size, and bulk actions by query against unindexed predicates. Set budgets on /definition size, search latency, field-check latency, and list endpoints, and load-test at realistic row counts.
Failure modes. Primary: alpha API breakage between releases (now evidenced); three-way version skew including a mediatheque floor that produces hard failures if unmet; search enabled by default on an environment that never planned for the endpoint; authorization gaps in a JSON API where policies are mandatory but easy to under-specify, extended to search scope and field checks; slug-check probing used to enumerate; and the unresolved future-dated release metadata. Secondary: the protocol spec changing under the package; the JS client stalling mid-adoption; Scout index drift producing inconsistent search results; installer side effects on an existing app; design-system drift once the JS admin is themed. Mitigations: pin and document the triple, run the conformance kit in our own CI, set panneau.search.enabled explicitly per environment, require route-level authorization tests including search and field checks, tune and test the panneau-search limiter, mount only the routes in scope, keep the admin behind a flag on a distinct route group, retain the fallback of a plain Laravel JSON API plus an in-house UI, and re-check release provenance before production use.
Ramp-up. Slightly higher again. A Laravel-fluent team will still pick up builders and repositories quickly, but onboarding now spans the protocol, the JS client, the definition/serialization model, search (repository vs Scout mechanics and scope rules), slug/field-check semantics including ChecksSlugs for non-Eloquent repositories, and media through a second sibling package. Budget a structured spike, one pilot resource end-to-end including a policy, a concurrency conflict, a slug check, and a search, plus a review focused on repository boundaries, filter/sort declarations, policy coverage, and rate-limiter placement. Training should keep emphasizing the adapter boundary so Panneau-specific patterns do not leak into domain code and a future exit stays cheap.
How can I help you explore Laravel packages today?