Ui Laravel Package

Product Decisions This Supports

• Build vs. buy for authentication. This package is the "buy" answer for the first slice of auth work: one composer require plus php artisan ui bootstrap --auth generates login, registration, password reset, email verification, controllers, routes, migrations, and Blade views. The license cost is zero (MIT); the real cost is the migration you eventually owe.
• Greenfield vs. brownfield policy. A clean rule you can put in an engineering standards doc: new projects → Breeze/Jetstream; existing apps on laravel/ui → keep pinned, upgrade only alongside Laravel majors. The package's own README endorses the migration path, which removes the political cost of setting that rule.
• Frontend stack standardization. Adopting this anchors you to Bootstrap + Blade (optionally Vue/React 18 scaffolding) and Vite. That's a stack decision as much as a package decision — it should be made against your existing design system, not by default.
• Legacy modernization roadmap. Every app with this dependency is a candidate for a "frontend scaffolding refresh" epic. Given v4.x spans Laravel 9–13 and only the latest major receives bug fixes, the trigger is naturally your next Laravel major upgrade. That's a defensible, pre-scheduled roadmap item rather than an unplanned fire.
• Feature prioritization guardrail. Do not scope 2FA, teams/organizations, passkeys, social login, API tokens, or session-management UI into work that assumes this package will grow to meet it. Those belong to Jetstream/Fortify/Sanctum; forcing them here means hand-rolling security-sensitive code.
• Prototype and internal-tool investment. Good default for MVPs, admin back offices, demos, and workshops where "plain, readable, working auth" beats sophistication and no one will file a design ticket.
• House-standard scaffolding (optional). Presets are macroable, so you can codify an internal UiCommand::macro('ourstack', ...) instead of forking. Cheap platform play — but it deepens the lock-in, so only do it if you're deliberately staying.
• Risk register entry. Treat it as a low-severity, high-certainty tech-debt line item: it works, it's maintained for compatibility, it is explicitly labelled legacy upstream.

When to Consider This Package

Adopt when:

• A brownfield Laravel app already depends on it and is stable — the cheapest correct action is to keep the pin and bump majors with Laravel.
• You need Bootstrap-styled auth in hours for an app with no design system (or an existing Bootstrap one) and no MFA/teams requirement.
• The audience is internal: admin panels, ops tools, back-office CRUD where stock Bootstrap views are acceptable.
• You want the generated code to live in your repo and be owned, reviewed, and customized rather than hidden behind a framework.
• You're producing teaching material or a demo where the simplest possible Laravel auth is a feature.

Look elsewhere when:

• Greenfield. Upstream itself points to Laravel Breeze (Tailwind/Blade) or Jetstream.
• You need more than baseline auth: 2FA, teams, API tokens, profile photos, session management, passkeys → Jetstream / Fortify.
• API-first, SPA, or mobile clients → Sanctum + Fortify; Blade scaffolds are dead weight.
• Tailwind or a component library is already mandated — the generated Bootstrap views become throwaway work on day one.
• You need vendor SLAs or an LTS branch. Only the latest major gets bug fixes; it's marked legacy; ecosystem gravity is thin (0 dependents, middling opportunity score, ~2.7k stars).
• Hardened security UX is a requirement beyond stock throttling and password resets — you need Fortify-level control over the auth pipeline.

How to Pitch It (Stakeholders)

Executives. laravel/ui is a free, MIT-licensed accelerator that turns authentication — login, registration, password reset, email verification — into an afternoon of work instead of a sprint, with no licensing fees and no lock-in, because the code is generated into our repository rather than licensed from a vendor. The honest framing is that it is a legacy accelerator, not a platform: Laravel's own documentation now steers new projects to Breeze and Jetstream, and the package receives bug fixes only on its latest major. Recommendation: leave it in place where it already runs (low risk, no action, no cost), exclude it from new product decisions, and pre-budget one contained migration epic per app to coincide with our next Laravel major upgrade. Do not fund new feature work that assumes this package will grow.

Engineering. Treat it as one-time code generation, not a runtime framework. The ui Artisan command copies stubs — controllers, routes, Blade views, migrations — into our codebase; from that moment they are ours to review, test, and secure. Keep the Composer dependency so the command and any preset macros remain available, but avoid architecture that assumes upstream will change. Pin deliberately: 4.x covers Laravel 9–13, and only the latest major receives fixes, so the major bump is part of every Laravel upgrade rather than an afterthought. Presets are macroable — if we standardize scaffolding, define an internal macro rather than forking the package. When auth is next touched, migrate incrementally to Breeze/Fortify: the generated views are the only genuine throwaway surface, so the swap is well contained.