Modernize Storefront SDK for v1.2

[roncodes]

Summary

• refactors all maintained runtime source to strict TypeScript while preserving the v1.1.14 public and wire contracts plus the accepted marketplace APIs from PR feat: add marketplace SDK helpers #11
• restores genuine ESM and directly constructible CommonJS, generates strict declarations, and ships a self-contained browser entry
• adds deterministic contract/failure tests with exact 100% statements, branches, functions, and lines plus an 86.32% critical-path mutation score
• verifies the exact packed tarball through npm, pnpm, Yarn, Bun, Vite, webpack, Next.js client/server, Ember 7 with Vite/Embroider, browser, SSR-safe import, and three TypeScript resolver modes
• modernizes CI, security, dependency automation, Changesets release PRs, npm trusted publishing/provenance, immutable checksummed artifacts, and scheduled/manual non-destructive API smoke testing
• rewrites the README and adds API, compatibility, migration, contribution, security, release, and audited route-contract documentation

Compatibility and security decisions

• the default constructor, newInstance, named exports, stores/actions, request verbs/paths/payloads, synchronous errors, resource hydration, and callable CommonJS shape are frozen by executable snapshots
• @fleetbase/sdk@1.2.13 cannot be safely externalized: webpack reports no ESM exports and its advertised CommonJS .js file is inside a type: module boundary
• the SDK is therefore a patched build-time-only input bundled into all runtime artifacts; consumers no longer install its vulnerable dependency graph
• countries-list and date-fns remain normal external runtime dependencies
• historical src/cart-store and src/customer-store deep paths were unreachable and blocked by the old exports map, so their active action-based replacements remain the compatible public surface

Verification

• pnpm run check
  • 364/364 statements
  • 306/306 branches
  • 189/189 functions
  • 343/343 lines
  • publint clean and all relevant Are the Types Wrong resolutions green
• pnpm run test:mutation: 164/190 mutants killed, 86.32%
• pnpm audit --prod --audit-level moderate: no known vulnerabilities
• final tarball: 360,212 bytes compressed; 1,767,919 bytes unpacked; 3-package clean runtime install
• final tarball passed ESM, callable CommonJS, Node16/NodeNext/Bundler declarations, browser global, npm/pnpm/Yarn/Bun, Vite 8, webpack 5, Next.js 16 client/server, and Ember 7 Vite/Embroider
• all previously pushed hosted checks are green, including Node 22/24/26, package managers, dependency review, production audit, and CodeQL

Release-owner setup after merge

• create/protect the documented npm-production and storefront-smoke GitHub environments
• configure npm trusted publishing for .github/workflows/publish.yml, then revoke the legacy token after the first trusted publish
• apply the documented required branch checks to main
• publish a prerelease under next, record Storefront Web/App and marketplace acceptance, then approve the stable release only if those application gates pass
• verify npm provenance, dist-tags, registry metadata, and the tarball SHA-256 attached to the GitHub Release

No package is published by this pull request.