Release 1.3.0: Trailers API and equipment attachments

[roncodes]

Summary

The published SDK and website example catalog do not cover the new Fleet-Ops Trailers API or Equipment attachment actions. This prepares 1.3.0 with those operations and a complete catalog for all 264 current Fleetbase/Core Postman requests.

$trailer = $fleetbase->trailers->create(['name' => 'Reefer', 'type' => 'reefer']);
$fleetbase->trailers->attachTrailerToVehicle($trailer->id, ['vehicle' => $vehicleId]);
$fleetbase->trailers->trackTrailer($trailer->id, ['latitude' => 1.29027, 'longitude' => 103.851959]);
$history = $fleetbase->trailers->listTrailerConnections($trailer->id);
$trailers = $fleetbase->vehicles->listVehicleTrailers($vehicleId);
$fleetbase->trailers->detachTrailerFromVehicle($trailer->id);

• Trailer resource, service, facade property/accessor, CRUD and custom actions; vehicle trailer listings live on VehicleService.
• Equipment attach/detach methods. Device/equipment fixture scenarios map to their canonical service methods rather than introducing scenario-specific APIs.
• Existing positional/direct-data and legacy envelope signatures remain supported. Added a published 1.2.0 API baseline to the compatibility gate.
• Updated the locked stack, Fleet-Ops/Core API commits, Postman inventory, executable examples, README, changelog, and 1.3.0 release notes/checklist.
• Fixed contract-test envelope placeholder naming for cross-resource scenarios and validate that scenario mappings preserve the canonical HTTP operation.

Sources and validation

• Postman: 7fe06b7c5e415a9aa292869e9037910896b049ad.
• Fleet-Ops routes/controllers: 2980fb39cd4ff58442d287907849efea3a2805ba.
• Disposable stack: 2612278517a56e5389e98c8fd08648e583c87226.
• Local unit suite: 37 tests / 4,628 assertions, including all 264 request fixtures and executable snippets, trailer hydration/active-record save and attachment-conflict mapping.
• Fresh Xdebug: 100% lines and branches (1,110/1,110 lines; 1,043/1,043 branches).
• Compatibility with 1.0.2, 1.0.3, 1.1.0 and published 1.2.0; PHPStan max, formatting and contract completeness checked locally.

The coordinated website PR #98 updates the vendored catalog and Postman submodule, validates their exact request-ID sets before postinstall, and synchronizes SDK examples during future submodule bumps. Its API documentation CI and Vercel preview both pass.

Release candidate evidence

SDK commit: 86be1e719e6d5c0bd8b8f266200f2de2da26fac2.

• CI 34341101047: PHP 7.4-8.5 lowest/latest dependencies, plain/Laravel/Symfony consumers, compatibility, quality, coverage, mutation and release-candidate jobs all passed.

• Security 34341101084: Composer audit/license, dependency review, secret scan and workflow CodeQL passed.

• Downloaded CI coverage confirms 100% lines and branches. Mutation evidence records 1,853 mutants, 1,634 killed, 218 escaped, one timeout, 88.18% MSI, 100% mutation-code coverage, and no ignored/uncovered mutants.

• Downloaded SHA256SUMS successfully verifies both the 1.3.0 archive and CycloneDX 1.7 SBOM. Archive SHA-256: 133f0194f7300ad8f065b25dda224ef6368e8ce687dfc3c5791f38d27954a32c.

• Disposable SDK contract 34341100984: passed on the same commit. Independently downloaded invocation state verifies all 264 expected request IDs, with 286 total attempts and final responses of 212 HTTP 200 and 52 HTTP 201. Both collections passed all 442 assertions with zero failed requests; the direct SDK smoke also passed auth, validation, create, retrieve, delete and not-found checks.

• API image tested: fleetbase/fleetbase-api@sha256:a88d506067bc6b6c72883957cd6e073c02aca5e201ce909c43947d7f4264195e.

Merging the reviewed release/v1.3.0 branch starts the existing guarded release workflow.