Modernize the Fleetbase JavaScript SDK for v2

[roncodes]

Summary

Modernizes the official Fleetbase JavaScript SDK as a compatibility-first 2.0.0-next.0 release candidate.

The implementation replaces the legacy source and hand-written declarations with strict TypeScript while preserving the published v1.2.13 root runtime contract and incorporating the pending v1.2.14 service-quote API. The contract inventory was cross-checked against the official Fleetbase Postman, Core API, and Fleet-Ops repositories.

Public API effect

• preserves all 86 published default and named root exports, constructors, resource/store methods, adapter extension points, return shapes, and legacy collection/string behavior
• adds the pending ServiceQuote resource and store contract from the maintained API sources
• fixes CommonJS loading, declaration resolution, resource state cleanup, dirty-only saves, destroy option forwarding, longitude validation, adapter propagation, collection behavior, runtime detection, and structured transport errors
• ships correct native ESM, true CommonJS, browser IIFE, source maps, and matching ESM/CommonJS declarations

Engineering and release changes

• strict TypeScript source with zero runtime dependencies
• deterministic behavior, compatibility, security, and failure-path suite enforcing 100% statements, branches, functions, and lines
• reviewed Stryker core mutation baseline: 634 mutants, 480 killed, 143 survived, 3 timed out, 8 uncovered; 76.18% score with a 76% ratchet
• exact candidate-tarball gates for Node 22/24; Linux, macOS, and Windows; npm, pnpm, Yarn, and Bun; Node16, NodeNext, and bundler type resolution
• production fixtures for Vite, webpack, esbuild, React, Vue, Svelte, Angular, Ember, Next.js, Nuxt, Expo web/React Native Android, and Edge Runtime VM
• Playwright execution in Chromium, Firefox, and WebKit
• dependency review/audit, CodeQL, Publint, Are The Types Wrong, export parity, source-map checks, package allowlist, and size budgets
• isolated read-only live API smoke workflow gated by FLEETBASE_PUBLIC_KEY
• Changesets release automation with split least-privilege jobs, protected npm environment, npm trusted publishing/provenance, immutable-tarball checksum evidence, registry byte verification, and GitHub releases
• refreshed README/badges, changelog, contribution guide, testing/compatibility/release policies, API source baseline, migration guide, and master to main migration runbook

Final evidence for 24c7817

• GitHub CI success: passing
• CodeQL and both Codecov checks: passing
• all framework, browser, package-manager, operating-system, type-resolution, dependency, quality, coverage, and package jobs: passing
• local pnpm run verify: passing
• tests: 23 passing
• coverage: 100% statements (709/709), branches (589/589), functions (342/342), and lines (660/660)
• package: 12 files, 136,732 packed bytes, 86 ESM/CommonJS parity-matched exports
• Publint: clean
• Are The Types Wrong: clean
• frozen dependency install: passing
• exact final tarball: passing in Chromium, Firefox, and WebKit
• release dry run: deterministic single tarball and checksum; no registry publication

Package artifact effect

The npm publication is intentionally allowlisted to 12 files: compiled runtime/declaration/source-map outputs plus README, license, changelog, and package metadata. Generated build output and local test/mutation artifacts are not committed.

Risk and rollback

The principal risk is undocumented edge behavior in legacy consumers despite the captured v1 contract. The prerelease next tag, exact-package consumer matrix, and first-party validation gate provide the adoption boundary. If a regression is found, do not promote to latest; fix forward with a new prerelease. Published versions are never overwritten.

Owner gates after review

This PR does not publish to npm and does not change the GitHub default branch. After approval:

1. Configure the protected npm environment and npm trusted publisher exactly as documented.
2. Merge and follow the documented master to main migration runbook.
3. Validate the next candidate in first-party Fleetbase consumers.
4. Approve publication, verify registry bytes and provenance, then promote a later stable release only after signoff.

Official API sources

• https://github.com/fleetbase/postman
• https://github.com/fleetbase/core-api
• https://github.com/fleetbase/fleetops

[codecov]

Welcome to Codecov 🎉

Once you merge this PR into your default branch, you're all set! Codecov will compare coverage reports and display results in all future pull requests.

Thanks for integrating Codecov - We've got you covered ☂️