- How do I install lexal/http-stepped-form in a Laravel application?
- Install it with Composer using composer require lexal/http-stepped-form. The package is distributed under that name, so standard Composer resolution applies. However, the available evaluation material shows no evidence of a Laravel service provider, config publish command, or facade, so plan to write the wiring code yourself and inspect the package source after installation. Pin an exact version rather than a floating constraint until you have reviewed the tag history.
- Does lexal/http-stepped-form support Laravel 11 and Laravel 12?
- This is not confirmed in the documentation excerpt or the technical assessment. Before committing, read the package's composer.json to check its illuminate/* constraints and PHP requirement. If it declares only older Illuminate versions, Composer will block installation on Laravel 11 or 12 unless the constraints are widened. Treat Laravel 11 and 12 support as an open question to verify in a spike, not an assumption.
- Is lexal/http-stepped-form Laravel-native or framework-agnostic PSR-15?
- The name and description suggest a Laravel package, but the assessment flags that the underlying implementation could be PSR-7 or PSR-15 middleware, or a plain PHP state machine, instead of something built on Laravel's HTTP kernel. If it is PSR-15, it will not drop into Laravel's middleware pipeline without an adapter. Inspect the source and composer.json for Illuminate or Symfony HttpFoundation dependencies to determine which it is before designing your integration.
- Where does lexal/http-stepped-form store step state between HTTP requests?
- The package must persist a step cursor and partial user input across requests, but the storage backend is not documented in the material provided. Possible implementations include the Laravel session, cache, database, or a signed client-side cookie. Read the source to confirm which one it uses, because that choice determines your scaling, multi-tenancy, and security posture. If it uses the session, confirm it is keyed strictly to the authenticated user.
- Can a user tamper with the step identifier and skip validation in lexal/http-stepped-form?
- That is the primary security surface for any stepped-form library and it must be verified directly in the code. Confirm that the step cursor is stored server-side or cryptographically signed, that each step re-runs its own validation on submission, and that a forged step identifier cannot reach a later step's data. Also check replay protection against double submission. If state is client-side and unsigned, do not use it for regulated or high-friction flows.
- Does lexal/http-stepped-form work with Inertia.js, Livewire, React, or Vue?
- For Inertia, Livewire, or SPA frontends, the package duplicates state that the frontend already owns, leaving two competing sources of truth for the current step. The technical assessment recommends implementing the wizard in the frontend framework and treating this package only as a reference design in that case. It fits best in a classic Laravel stack using Blade, session state, and POST/redirect/GET.
- Does the package own validation, or can I use Laravel FormRequests?
- This is unclear from the available material; the package may ship its own rules or delegate validation to the host application. The practical answer is to keep validation server-authoritative at every step regardless of where the rules live. Test that FormRequests can coexist with the package's step handling, and if they conflict, wrap the package's step controller with your own FormRequest validation.
- Is lexal/http-stepped-form safe to use with Laravel Octane?
- Octane safety depends on whether the package holds mutable static or singleton state across worker requests, which is not documented. Any stepped-form library that caches the current step in a static property will leak state between users under Octane. Review the source for static properties and singletons before running it on Octane, and prefer a session- or database-backed implementation.
- Can users navigate back, save progress, and resume a multi-step form later?
- Branching, back navigation, and save-and-resume are explicitly listed as open questions in the technical assessment, so verify them against the source before relying on them. Back navigation is usually the simpler case: the earlier step's stored data must still be present and re-validated. Save-and-resume requires durable storage plus a resumption token, which is a materially larger feature than session-only state.
- Is lexal/http-stepped-form production-ready and well maintained?
- Adoption signals are effectively zero: one star, no dependents, a single maintainer, and no visible governance or security policy. The release metadata is also suspect, with a tag dated in the future, so inspect the actual commit history and tag dates before trusting version numbers. For customer-facing regulated flows, adopt the pattern by writing your own step controller, or spike the package for one to two days and vendor or fork it rather than taking it as a dependency of record.