Tomato User Activities Laravel Package

Product Decisions This Supports

• Build vs. buy for audit/activity history: This package lets you avoid building a bespoke activity-log subsystem (schema, polymorphic model, timeline queries, retention) from scratch — a strong "buy" candidate if you're already on Laravel/TomatoPHP, and a quick way to de-risk a compliance or admin-visibility feature without a dedicated sprint.
• Feature scoping for "user activity" requirements: Supports decisions on scope — e.g., whether v1 needs only logins/profile changes (out-of-the-box "automatic logging of common user actions") or whether you need fine-grained, domain-specific audit semantics that require custom instrumentation.
• Roadmap sequencing for admin panels/dashboards: The timeline-ready queries and Filament/TomatoPHP integration mean an "Activity" tab in user profiles or an admin dashboard can ship as a fast follow rather than a standalone initiative — useful when prioritizing quick win visibility features.
• Compliance and support-triage use cases: Supports decisions about whether to expose activity history to support agents or customers, since the package surfaces user actions in a reviewable timeline — relevant for investigation and accountability workflows.
• Data retention and privacy policy decisions: "Configurable retention" forces the product team to define and own a retention policy — a PM decision, not just an engineering one (how long do we keep activity data, what PII must never be logged).
• Platform standard-setting: If adopted, establishes activity logging as a shared platform capability rather than per-team reinvention — informs decisions about internal standards across the Laravel estate.

When to Consider This Package

Consider it when:

• You're on a Laravel/PHP monolith or modular monolith, ideally already using TomatoPHP/Filament conventions, and need user activity history with minimal setup.
• You need a bounded audit/visibility capability (logins, profile updates, record changes) — not a core business workflow dependency.
• You want a timeline UI in an admin panel or user profile quickly, without designing a logging data model.
• You're a small team comfortable with community packages and can own retention, indexing, and privacy review internally.
• You can run a sandbox compatibility spike before production — verify PHP/Laravel/database versions, auth model, and Filament/TomatoPHP dependency versions.

Look elsewhere (or plan to build internally) when:

• You're not on Laravel, or your app diverges materially from TomatoPHP conventions (non-trivial integration cost).
• You need enterprise-grade audit guarantees: immutability/tamper-evidence, centralized multi-service event collection, export, granular permissions, or guaranteed coverage across distributed services.
• The 0 stars / 0 dependents / sparse release notes signal is unacceptable for your risk appetite — this is a community package with unproven support cadence; validate issue responsiveness and maintenance before committing.
• You have strict PII/high-volume requirements where write amplification and unbounded activity table growth must be solved at the architecture level (queues, partitioning, archival).
• Release transparency matters: v1.0.3 discloses only a Full Changelog link — no breaking changes, migrations, or security notes — so treat upgrades as unverified until you inspect the diff.

How to Pitch It (Stakeholders)

For executives: This is a low-cost, MIT-licensed Laravel package that gives us user activity history — logins, profile changes, record edits — surfaced as a timeline in admin tools, with our own retention controls. It converts a potential "build an audit system" initiative into a small integration effort, enabling fast delivery of admin transparency and support-triage features. Key caveats: it's a young community package (minimal stars/dependents, sparse release notes), so we recommend a time-boxed compatibility spike and a retention/PII policy owned by product before production adoption.

For engineering: Expect standard Laravel package integration — Composer install, service provider registration, publishable config and migrations, then instrumentation of critical user actions. It provides polymorphic activity records, timeline queries, configurable retention, and Filament/TomatoPHP integration. Before committing: publish and review migrations/schema ownership, confirm PHP/Laravel/DB compatibility, inspect the v1.0.2→v1.0.3 diff, and plan for indexes, queued/async writes, pruning, and PII review. Start in a sandbox, instrument high-value events, QA with privacy review, then stage to production with post-rollout monitoring.