Mary Ui Starter Kit Laravel Package

Product Decisions This Supports

• Whether to ship a public, self-serve demo at all — and how to do it without bespoke engineering. The demo lifecycle (scheduled reset, rotating published credentials, login-form prefill, abuse restrictions, "data is temporary" notice) is now a consumable dependency. That converts demo-from-a-wishlist into demo-by-default, with a known cost.
• Build vs. buy for demo infrastructure. The hand-rolled demo mode was deleted in favor of an extracted package reused across two projects. That is an explicit decision that demo plumbing is not a differentiator — nothing downstream should re-implement it.
• Shared vs. scoped demo tenancy. For demos that expose list screens where visitors create rows, DEMO_SANDBOX=scoped is the safe default for public traffic; shared remains acceptable for gated or sales-led demos where clutter is not a credibility risk. This is a real product trade-off (a first visitor's test accounts are a second visitor's mess), and it now has a config flag instead of a fork.
• Marketing/campaign cadence unblocked from deploys. DEMO_BANNER_* reads from the environment, so demo copy and framing can change without a release. That is a launch-velocity decision, not a technical one.
• Ops safety as a release gate. demo:doctor exits non-zero on configurations that would destroy data or publish a secret. That turns "don't fat-finger the demo config" into an enforceable CI check rather than a runbook paragraph.
• Upgrade-window planning. Laravel 13.26 → 13.33 pulled guzzle 7 → 8, brick/math 0.18 → 1.0, and laravel/mcp 0.9 → 1.0. These transitive majors are the decision item for teams carrying downstream customizations; they need a compatibility sign-off slot on the roadmap.

When to Consider This Package

Consider it when:

• You need a hosted, publicly reachable demo of a Laravel application and do not want to own reset scheduling, credential rotation, or anti-abuse yourself.
• You operate demo instances across more than one product or repository. The extraction is the point — one implementation, one place to fix it.
• Your demo surface includes list screens where visitors create records and accumulated clutter (or the fear of deleting someone else's row) degrades the experience. Scoped sandboxing is the specific fix.
• Marketing or compliance needs a visible "this data is temporary" notice whose countdown cannot drift from the actual reset schedule. Deriving both from the same cron expression is the guarantee here.
• You are on or moving to Laravel 13.x and can absorb the transitive majors now.

Look elsewhere, or defer, when:

• The demo sits behind SSO or an allowlist, so abuse risk and visitor collision are already low — the scoping machinery buys little.
• You cannot take guzzle 8, brick/math 1.0, or laravel/mcp 1.0 yet because of downstream pins.
• You need isolation beyond a single model. Only App\Models\User is marked; roles and permissions stay shared by design, and unique:users,email validation is global across sandboxes, so two visitors cannot register the same address.
• Your product expects logout to end a visitor's session state. It does not — the reset/clear button is the only clean slate, and that has to be communicated in the UI.

How to Pitch It (Stakeholders)

For executives: this release makes a public demo cheap and safe. Scheduling, credential rotation, per-visitor separation, and an honest "this is temporary" banner are now a maintained dependency rather than something we build and babysit. Risk to ordinary deployments is minimal — the sandbox code is inert unless explicitly switched on, and there is a test asserting that rather than a promise. The concrete cost is an upgrade cycle: three transitive majors moved, so we need a short compatibility pass before we adopt.

For engineering: do not re-implement demo mode; adopt lauroguedes/laravel-demo-mode. Wire demo:doctor into CI so a data-destroying or secret-publishing configuration fails the build. When adopting scoped sandboxing, remember the model must be explicitly marked — any new visitor-writable model needs the same treatment, or it silently stays shared. Plan the guzzle 8 / brick/math 1.0 / laravel/mcp 1.0 upgrades against our forks. 238 tests pass, Pint and Rector are clean, and isolation was verified manually across two browser sessions — but that verification lives in a PR description, not a test, so re-validate in our own environment.