- How do I install flex/express in a Laravel application?
- Install it with Composer using the package name flex/express, then publish the bundled configuration file so your vendor credentials live outside the package source. Because it is a Laravel-style package built around a service provider, config, and a facade, registration is normally automatic via package discovery. Check the repository README for the exact publish tag and any required facade alias before wiring it into your code.
- Does flex/express support both 快递鸟 (Kuaidiniao) and 快递100 (Kuaidi100) in one package?
- Yes. The package describes itself as a courier tracking SDK covering both Kuaidiniao and Kuaidi100, so you can query either aggregator from the same Laravel application. In practice the two vendors differ in signing, endpoint shape, and error codes, so expect separate configuration blocks and separate response payloads rather than a single unified result object. Normalizing those payloads is work your application should own.
- Which PHP and Laravel versions does flex/express support?
- The package's composer.json constraint on illuminate/support governs this, and the repository does not publicly document a tested version matrix. The last release was in September 2022, which predates Laravel 11 and 12, so the constraints may need widening for a current stack. Confirm the supported PHP range and Guzzle version pinning in a scratch branch before committing to it.
- Does flex/express support 订阅推送 callback push, or only 即时查询 instant query?
- This is unverified from the available documentation and must be your first spike. The read-only instant query path is straightforward: publish config, add credentials, call the query method. Subscription registration, callback parsing, and signature verification are the pieces you actually need at any volume, and a thin wrapper may not implement them at all. If it does not, plan to build that layer yourself or fork the package.
- How do I configure API keys and signing secrets for 快递鸟 or 快递100?
- Credentials go in the published config file, typically the EBusinessID, AppKey, and customer identifiers issued by the vendor console, plus the signing secret used to hash request payloads. Keep these in your .env file and reference them from config so they never land in version control. Both vendors sign requests by hashing URL-encoded parameters in a specific order, so a wrong key or reordered field produces opaque error codes rather than a clear failure.
- Is flex/express safe to put on a production critical path?
- Not unmodified. The package has roughly 31 stars, zero dependents, and no release since September 2022, which means there is no community to absorb a Laravel compatibility break and effectively a bus factor of one. Vendor drift is the bigger risk, since both Kuaidiniao and Kuaidi100 iterate on endpoints, signing rules, and error taxonomies, and a stale SDK breaks silently when they do. Treat it as a one to two day accelerator to fork and own, not as a dependency you install and forget.
- How do I test courier tracking without calling the live vendor API?
- Put an application-owned interface in front of the package, for example a TrackingProvider contract with track, subscribe, and handleCallback methods, and implement it with an adapter over flex/express. Tests then bind a fake implementation and never touch HTTP. For the adapter itself, record real vendor responses as fixtures and add PHPUnit coverage around signing and response parsing, which is where the fragile logic lives.
- Does flex/express handle rate limits, retries, and timeouts?
- The package is a thin SDK wrapper, so calls are likely bare Guzzle requests without a retry policy or backoff. The repository does not document rate-limit handling, which matters because both aggregators throttle queries and apply per-waybill query frequency rules. Set explicit timeouts and wrap calls in your own retry logic, and consider queueing tracking polls rather than firing them inline during a web request.
- Should I call flex/express directly from controllers or Eloquent models?
- No. Keep the package behind a first-party boundary so controllers and models never see vendor-shaped payloads. Define a contract such as TrackingProvider plus a normalized TrackingEvent DTO carrying timestamp, a status enum, location, description, and the raw payload for audit. That seam caps the blast radius if the package is abandoned and lets you add a second aggregator or direct carrier APIs later without touching call sites.
- What are the alternatives to flex/express for courier tracking in Laravel?
- You can call the Kuaidiniao and Kuaidi100 HTTP APIs directly with Laravel's Http client, which removes an unmaintained dependency and gives you full control over signing and retries. The trade-off is that you must implement parameter ordering, MD5 or MD5-of-URL-encoded-payload signing, and error-code mapping for each vendor yourself. Given the package's size, forking its source into your own namespace is often the fastest middle path.