ralphjsmit/stubs
Take control of Laravel's generator stubs. This package lets you publish and override the template files behind artisan make commands, so generated classes, migrations, and tests follow your project's own conventions and coding style, all configured simply.
Architecture fit. Before any fit claim, the record must be treated as unresolved. The install name ralphjsmit/stubs and the description point at a stub-publication package — a build-time, zero-runtime-footprint tool that copies Laravel's Artisan make:* templates into the project so teams can commit customized scaffolding (DTOs, actions, form requests, factories, tests). The repository URL, repository description ("fluent filesystem for PHP"), and star count point at ralphjsmit/filesystem — a runtime convenience wrapper over the Storage facade. These sit at different layers and carry different risk budgets. The stubs reading is architecturally clean: the output is source code that humans review, so the blast radius is bounded by code review. The filesystem reading is materially riskier: it inserts an abstraction between application code and real file I/O, and must never touch customer uploads, tenant document storage, export pipelines, or billing artifacts. As TPM I would plan against the stubs reading — it is the one the name, description, and release notes corroborate — while formally recording the artifact as unresolved until Packagist identity, namespace, and service provider are confirmed from source.
Integration feasibility. Mechanically trivial in either reading: one composer require, optionally a vendor:publish call, and an additive stubs/ directory or a thin adapter class. Low friction is precisely the hazard here — it invites adoption without a recorded decision, and an unrecorded dependency is one nobody owns. Feasibility is high for a 1–3 day spike, moderate for a scoped internal rollout, and low against any real dependency-governance gate. The signals that matter to a governance gate are all negative: 18 stars, 0 dependents, last release 2023-02-17, single maintainer, and metadata that does not self-consistently identify the package. The metadata mismatch is itself a supply-chain finding — we cannot state which package identity and version we would be pinning, which undermines even the "just lock the version" argument.
Technical risk. High relative to value on offer. The genuine upside under the stubs reading is modest but real: encode house conventions once and every artisan make:* produces compliant scaffolding, converting "consistency by code review" into "consistency by default." That is measurable in onboarding time, time-to-first-merged-PR, and review comments per boilerplate file. The critical caveat for a TPM is that Laravel already supports publishing its own stubs; the package is convenience, not capability. Downside: an unmaintained dependency in the build path, ambiguous identity, a single maintainer with no disclosure process, and — under the filesystem reading — an extra layer over data-handling code. The 0.68 score is generous against these signals. Treat this as a preference bet, not a platform bet, and keep it out of anything with an SLA, compliance scope, or security-response requirement.
Key questions (TPM owns resolution; Laravel lead is technical reviewer):
ralphjsmit/stubs or ralphjsmit/filesystem? Which resolves on Packagist today, under what namespace and service provider, and does the repository still exist? No further work proceeds until this is answered in writing.Storage at our real call sites, or does it silently diverge?Stack fit. Conditional and narrow. Under the stubs reading, fit is good for a standardized Laravel service template or platform starter: publish stubs, review them as code, commit them, and let existing generators pick them up. Value compounds with headcount and service count; blast radius stays near zero because generated output is reviewed like any other PR. Under the filesystem reading, fit is confined to internal, non-critical tooling — admin exports, seeders, fixtures, one-off migration scripts — and only behind an internal adapter class. It does not belong in upload paths, tenant document storage, media libraries, billing artifacts, or backup tooling with an uptime commitment. If the identity cannot be resolved, stop: unresolved means unsupported.
Migration path. No data migration in either case, which is the point — this should never consume roadmap capacity. For stubs: run vendor:publish, diff against framework defaults, commit the customized set, and document the regeneration step in the repo README so a future framework bump is a known procedure rather than archaeology. Rollback is deleting the published directory and reverting one commit. For filesystem: introduce a single internal service class wrapping the call sites, with native Storage as the fallback path, so a revert is a one-file change rather than a sweep. Both are hours of work, not sprints, and both should be sequenced as internal tooling, explicitly outside the product roadmap.
Compatibility. Non-negotiable gate before any pilot. Verify in a sandbox against the exact Laravel and PHP versions in production: Composer constraints resolve without --ignore-platform-reqs, autoloading works, service provider discovery (or manual registration) is documented, publish tags do not collide with what we already ship, and existing test suites still pass with the package installed but unused. For the stubs reading, also verify that a make:model run after publishing produces a diff we actually want — if the generated output is identical to the framework default, the package is buying us nothing and the evaluation is over.
Sequencing. (1) Identity resolution and a written record of which package we are evaluating — one hour, blocking. (2) Sandbox install and compatibility check on the production matrix — half a day. (3) Time-boxed spike at real call sites, capped at three days, with a pre-agreed success metric (boilerplate lines eliminated, or minutes saved in onboarding). (4) Decision: adopt-behind-adapter, fork, or build the equivalent internally in an afternoon. (5) If adopted, pin the exact version, add a CODEOWNERS entry, and schedule annual re-evaluation. If step 3 exceeds its time box, kill it and build internally — that is the expected outcome, not a failure.
Maintenance. Effectively zero upstream maintenance and meaningful downstream maintenance. No release since February 2023 and a single maintainer mean the package should be assumed frozen. Our cost is the pin, the annual re-evaluation, the CODEOWNERS entry, and roughly half a day per year — plus the larger hidden cost of a fork if a framework upgrade breaks it. For the stubs reading, maintenance is mostly ours anyway: the committed stub files are our code, and they need updating when Laravel changes its generators. Plan for the package to become vestigial after the initial publish, at which point removing it is a cleanup task nobody schedules.
Support. Assume no upstream support, no CVE triage, and no security disclosure path. That is acceptable for a build-time stubs tool and unacceptable for anything on a data path. Internal support must be a named owner; if no engineer will put their name on it, the correct answer is no. Escalation path is "revert the adapter or delete the stubs directory," which must be written down before adoption rather than invented during an incident.
Scaling. Low ceiling, low risk in the stubs reading — it scales linearly with team size and service count and costs nothing at runtime. In the filesystem reading, scaling concerns are the ones that bite: large files, streaming and resumable semantics, and concurrency behavior under load. An extra abstraction layer is exactly the thing you end up debugging yourself when a 2 GB export stalls, which is why that reading stays out of any high-volume path regardless of how clean the API looks.
Failure modes. (1) Identity failure — we install the wrong package or a name that no longer resolves; mitigated by making identity a hard gate. (2) Runtime incompatibility — a 2023 release silently failing or misbehaving on a current framework; mitigated by the sandbox matrix check and an exact pin. (3) Stale stubs — generated code drifts from framework conventions after an upgrade, producing subtly outdated scaffolding; mitigated by a documented regeneration step and a periodic diff against defaults. (4) Abandonment — no upstream fix ever arrives; mitigated by the adapter/fork boundary and by preferring native Storage or Laravel's own stub publishing wherever the wrapper adds nothing. (5) Silent divergence — the wrapper's behavior differs from native Storage at an edge case nobody tests; mitigated by limiting call sites and keeping the native fallback live. (6) Governance erosion — approving an 18-star, zero-dependent, stale package sets a precedent that makes the next exception easier; that precedent is the most expensive failure mode on this list.
Ramp-up. Under an hour for any Laravel developer in either reading — the API surface is small and the concepts are familiar. The real ramp-up cost is organizational: teaching the team when not to use it, and making sure the committed stubs are understood as owned code with an update procedure rather than framework magic. Budget a short written note in the repo, a mention in onboarding, and a line in the tooling decision log. If the team cannot articulate in one sentence what the package does for them, it is not ready to adopt.
How can I help you explore Laravel packages today?