Release v2.0.0: SDK modernization and consumer compatibility gates

[roncodes]

Summary

Modernize the official JavaScript/TypeScript SDK on release/v2.0.0, preserving the v1 consumer contract. This draft supersedes historical PR #33, closed by the release-branch rename. The default branch is now main; this PR remains unmerged.

Merging this release PR into main authorizes automatic tagging, npm publication, and GitHub release creation. npm authentication uses the existing NPM_AUTH_TOKEN, matching the other Fleetbase modules; no trusted-publisher registration is required.

Completed fixes

• Restored BrowserAdapter's request interception for all verbs, serialized mutation envelopes, spreadable headers, and current credential/configuration handling.
• Corrected JSON payloads containing body and plain API GeoJSON driver coordinates.
• Preserved Navigator's old declaration path and removed the newly introduced host-nullability diagnostic.
• Retained Node 20.19.4 runtime compatibility while using modern build tooling.
• Added permanent regression tests and repeatable actual-consumer diagnostics.
• Expanded packed runtime CI across Node 20/22/24 and TypeScript consumer CI across 5.0.4/6.0.2.
• Consolidated release operations into release.yml: a merged release/v* PR into main validates the exact reviewed merge commit, creates its annotated tag, publishes the SDK with provenance, verifies registry checksums and clean consumers, and creates a GitHub release with evidence.
• Removed the duplicate tag-triggered publication workflow, enable flag, shared tag-token dependency, and per-release environment approval. Publication continues in the same workflow, so GitHub token-created tags do not need to trigger another workflow.
• Added safe retries, conflicting-tag protection, and a main-only manual recovery entry point. Ordinary PRs and pushes do not publish.
• Aligned npm authentication with Fleet-Ops, Storefront, and Ledger through NPM_AUTH_TOKEN, supplied to npm as NODE_AUTH_TOKEN only in credential preflight and publication steps. A missing secret fails before tagging; provenance and exact artifact verification remain enabled.
• Aligned branch/package/release-note versions to 2.0.0 and updated release documentation. No tag or package has been published.

Verification

• Full local SDK verification passes: 27 SDK tests and 100% statements, branches, functions, and lines, plus build/package/type/export checks.
• Five release automation tests pass, including exact-commit tagging, repeat runs, local and remote tag collisions, and mutation restrictions outside Actions. Tests use isolated local repositories, not production tags.
• Credential preflight checks pass with synthetic inputs: missing token fails, a dummy token succeeds without output, and the publish step references the expected secret. No real credential was exposed or used to publish.
• All nine base consumer probes pass against the packed candidate on Node 20.19.4.
• Navigator's actual adapter/provider suites pass 32/32; its typecheck returns to the existing 15 unrelated camera/theme diagnostics with no new SDK diagnostic.
• Storefront's actual SDK hook, auth/language header setup, and Place creation pass against the packed artifact.
• Production Android Metro bundles for both actual apps pass with the packed PR feat: add released driver stores with verified response contracts #35 candidate. No native binary/device acceptance is claimed.
• Workflow syntax validation and release metadata validation pass; publication dry run succeeds without publishing. Hosted checks must pass on the final reviewed commit.

PR #35 remains a separate reviewable change for released driver stores; its response handling and root exports are fixed on its own branch, with unreleased inspection APIs deferred. It is not merged here.

Remaining owner gates before merge

• Complete native iOS/Android device acceptance in both apps.
• Review and merge feat: add released driver stores with verified response contracts #35 if those additional stores should ship in 2.0.0.
• Preserve main's one-reviewer protection and require strict CI success and CodeQL checks.
• Confirm the existing organization NPM_AUTH_TOKEN is available to fleetbase-js and authorized for @fleetbase/sdk. Organization-secret access could not be inspected with the current GitHub permissions; this is not evidence that the secret is missing. No new npm trusted-publisher registration or per-release approval is required.
• Approve the final release candidate before merging this draft. The merge itself starts the release; there is no second enable switch or approval step.

No application source changes, PR merge, release tag, or npm publication were performed. See docs/releasing.md for automatic release and recovery instructions, and docs/consumer-compatibility-review.md for historical failures, fixes, exact revisions, and acceptance limits.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (main@681c8cb). Learn more about missing BASE report.

Additional details and impacted files

@@           Coverage Diff            @@
##             main       #36   +/-   ##
========================================
  Coverage        ?   100.00%           
========================================
  Files           ?        17           
  Lines           ?       866           
  Branches        ?       144           
========================================
  Hits            ?       866           
  Misses          ?         0           
  Partials        ?         0           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.