Statamic Alpine Csp Forms Laravel Package

Product Decisions This Supports

• Build vs. buy (or rather, adopt vs. maintain): The driver was moved out of the UAMS site into a reusable Statamic add-on. If your roadmap already includes Statamic forms with Alpine-driven field conditions, adopting this avoids maintaining a bespoke CSP-safe form driver in-house.
• Security/compliance roadmap: Strict Content Security Policy is often a compliance or hardening requirement. This package supports the decision to keep CSP tight without giving up dynamic form behavior, rather than relaxing CSP with unsafe-eval/unsafe-inline.
• Feature scoping: Browser-side field-conditions evaluation is a narrow, well-defined capability. This supports scoping form work to "conditions render client-side under CSP" rather than expanding into a custom frontend framework.
• Platform standardization: If your product surface is Statamic + Alpine, this supports standardizing form behavior on one add-on instead of per-site JavaScript.
• Risk tracking: As a 0.x pre-release, this is a candidate for pilots and internal tooling, not a dependency to bake into a committed customer-facing roadmap without a version pin and upgrade budget.

When to Consider This Package

Consider it when:

• You are building on Statamic and already use Alpine.js for form interactivity.
• You enforce a strict CSP and cannot use unsafe-eval/unsafe-inline for form field conditions.
• You need client-side field conditions (show/hide/enable fields) without writing and maintaining a custom CSP-safe driver.
• You are comfortable consuming a 0.x pre-release, pinning versions, and reading release notes for breaking changes.
• MIT licensing and Packagist distribution fit your procurement and dependency policies.

Look elsewhere when:

• You are not on Statamic (this is a Statamic add-on, not a general Laravel form package).
• You are not using Alpine, or you can meet requirements with server-side conditional rendering.
• You need a stable 1.0+ API with SemVer guarantees; minor releases here can carry breaking changes until 1.0.0.
• You need a broad form-building feature set; this is a focused CSP-safe driver and conditions evaluator, not a full form framework.
• You cannot accept a young package with a small release history and limited public adoption evidence.

How to Pitch It (Stakeholders)

For executives: This is a small, MIT-licensed Statamic add-on that lets dynamic form behavior run under a strict Content Security Policy. It was extracted from a real site, which reduces the cost and risk of building and maintaining that capability ourselves. The main caveat is maturity: it is a 0.x pre-release, so we should pilot it with pinned versions rather than treat it as a long-term stable dependency.

For engineering: v0.1.0 packages the CSP-safe alpine_csp form JavaScript driver and its browser-side field-conditions evaluator as a Statamic add-on. It is CSP-safe by design, avoids bespoke per-site JavaScript, and is published under MIT. Engineering should note that pre-1.0 minor releases may include breaking changes called out at the top of release notes, so version pinning, changelog review, and an upgrade path are required before production adoption.