@fleetbase/fleetops-engine 0.6.65 → 0.6.66

package/server/src/Support/Telematics/TelematicService.php

@@ -194,6 +194,9 @@ class TelematicService
 
     public function ingestDeviceSnapshot(Telematic $telematic, TelematicProviderInterface $provider, array $payload): array
     {
+        if ($provider instanceof \Fleetbase\FleetOps\Contracts\TelemetryProviderInterface) {
+            return app(Telemetry\Ingestor::class)->ingest($telematic, $provider, $payload, $this);
+        }
         $device = $this->linkDevice($telematic, $provider->normalizeDevice($payload));
 
         $event  = null;
@@ -296,9 +299,13 @@ class TelematicService
             'internal_id'    => $sensorIdentity ?? $this->makeSensorIdentity($sensorData, $device),
         ]);
 
+        if (($sensorData['_ordered_telemetry'] ?? false) && $sensor->exists && $sensor->last_reading_at
+            && (!$sensorData['recorded_at'] || Carbon::parse($sensorData['recorded_at'])->lte(Carbon::parse($sensor->last_reading_at)))) {
+            return $sensor;
+        }
         $sensor->company_uuid     = $telematic->company_uuid;
         $sensor->name             = $sensorData['name'] ?? $sensorData['sensor_type'] ?? $sensor->type ?? 'Sensor';
-        $sensor->unit             = $sensorData['unit'] ?? null;
+        $sensor->unit             = $sensorData['unit'] ?? (($sensorData['_ordered_telemetry'] ?? false) ? $sensor->unit : null);
         $sensor->last_value       = isset($sensorData['value']) ? (string) $sensorData['value'] : $sensor->last_value;
         $sensor->last_reading_at  = $sensorData['recorded_at'] ?? $sensorData['last_reading_at'] ?? $sensor->last_reading_at ?? now();
         $sensor->status           = $sensorData['status'] ?? 'active';
@@ -535,7 +542,8 @@ class TelematicService
             $device->status = $connectionStatus;
         }
 
-        $device->meta = array_merge($device->meta ?? [], [
+        $mergeMeta    = ($payload['_ordered_telemetry'] ?? false) ? 'array_replace_recursive' : 'array_merge';
+        $device->meta = $mergeMeta($device->meta ?? [], [
             'external_id'       => $externalId,
             'provider_status'   => array_filter([
                 'status'    => $payload['status'] ?? null,
@@ -636,6 +644,10 @@ class TelematicService
     protected function applyDeviceEventTelemetry(DeviceEvent $event, array $eventData, ?Device $device = null, bool $wasRecentlyCreated = true, ?Telematic $telematic = null): void
     {
         $location = $this->normalizeLocation($eventData['location'] ?? null);
+        if (($eventData['_history_only'] ?? false) && ($eventData['_ordered_telemetry'] ?? false)) {
+            // DeviceEvent retains source-time history; Position would timestamp this old fix as current.
+            return;
+        }
 
         $device ??= $event->device;
         if ($device) {
@@ -654,6 +666,13 @@ class TelematicService
         }
 
         $attachable = $device?->attachable;
+        if (($eventData['_ordered_telemetry'] ?? false) && $attachable) {
+            $attachable = $attachable->newQuery()->where('uuid', $attachable->uuid)->lockForUpdate()->first();
+            $currentAt  = data_get($attachable?->telematics, 'last_event_at');
+            if ($currentAt && $event->occurred_at && $event->occurred_at->lte(Carbon::parse($currentAt))) {
+                return;
+            }
+        }
         if ($attachable instanceof Vehicle) {
             $this->updateVehicleTelemetry($attachable, $location, $eventData, $event);
         } elseif ($attachable instanceof Trailer) {
@@ -689,7 +708,8 @@ class TelematicService
         ]);
         $trailer->save();
 
-        broadcast(new TrailerLocationChanged($trailer, ['source' => 'telematics', 'device_event_uuid' => $event->uuid, 'provider' => $event->provider]));
+        $broadcast = new TrailerLocationChanged($trailer, ['source' => 'telematics', 'device_event_uuid' => $event->uuid, 'provider' => $event->provider, 'position_at' => $event->occurred_at?->toISOString()]);
+        $this->broadcastTelemetry($broadcast, $eventData['_ordered_telemetry'] ?? false);
     }
 
     protected function updateVehicleTelemetry(Vehicle $vehicle, array $location, array $eventData, DeviceEvent $event): void
@@ -717,7 +737,7 @@ class TelematicService
             'last_event_uuid'     => $event->uuid,
             'last_event_id'       => $event->public_id,
             'last_event_type'     => $event->event_type,
-            'last_event_at'       => optional($event->occurred_at)->toDateTimeString() ?? now()->toDateTimeString(),
+            'last_event_at'       => ($eventData['_ordered_telemetry'] ?? false) ? $event->occurred_at?->toISOString() : (optional($event->occurred_at)->toDateTimeString() ?? now()->toDateTimeString()),
             'last_device_uuid'    => $event->device_uuid,
             'last_provider'       => $event->provider,
             'last_telemetry_data' => array_filter([
@@ -731,11 +751,22 @@ class TelematicService
         ]);
         $vehicle->save();
 
-        broadcast(new VehicleLocationChanged($vehicle, [
+        $broadcast = new VehicleLocationChanged($vehicle, [
             'source'            => 'telematics',
             'device_event_uuid' => $event->uuid,
             'provider'          => $event->provider,
-        ]));
+            'position_at'       => $event->occurred_at?->toISOString(),
+        ]);
+        $this->broadcastTelemetry($broadcast, $eventData['_ordered_telemetry'] ?? false);
+    }
+
+    protected function broadcastTelemetry(object $event, bool $afterCommit): void
+    {
+        if ($afterCommit) {
+            \Illuminate\Support\Facades\DB::afterCommit(fn () => broadcast($event));
+        } else {
+            broadcast($event);
+        }
     }
 
     protected function makePositionData(array $location, array $eventData): array

package/server/src/Support/Telematics/Telemetry/Configuration.php

@@ -0,0 +1,30 @@
+<?php
+
+namespace Fleetbase\FleetOps\Support\Telematics\Telemetry;
+
+use Fleetbase\FleetOps\Contracts\TelemetryProviderInterface;
+use Fleetbase\FleetOps\Models\Telematic;
+use Fleetbase\FleetOps\Support\Telematics\TelematicProviderRegistry;
+
+class Configuration
+{
+    public static function provider(Telematic $connection): TelemetryProviderInterface
+    {
+        $provider = app(TelematicProviderRegistry::class)->resolve($connection->provider);
+        if (!$provider instanceof TelemetryProviderInterface) {
+            throw new \InvalidArgumentException('Provider does not support durable position ingestion.');
+        }
+
+        return $provider;
+    }
+
+    public static function options(TelemetryProviderInterface $provider): array
+    {
+        return array_replace(config('telematics.telemetry', []), $provider->telemetryOptions());
+    }
+
+    public static function forConnection(Telematic $connection): array
+    {
+        return self::options(self::provider($connection));
+    }
+}

package/server/src/Support/Telematics/Telemetry/Inbox.php

@@ -0,0 +1,61 @@
+<?php
+
+namespace Fleetbase\FleetOps\Support\Telematics\Telemetry;
+
+use Fleetbase\FleetOps\Jobs\ProcessTelematicDelivery;
+use Fleetbase\FleetOps\Models\Telematic;
+use Illuminate\Support\Facades\Crypt;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Str;
+
+class Inbox
+{
+    public function accept(Telematic $telematic, array $payload, string $source, ?string $run = null, ?string $receivedAt = null): string
+    {
+        $json = json_encode($payload, JSON_THROW_ON_ERROR);
+        $id   = (string) Str::uuid();
+        DB::table('telematic_deliveries')->insert([
+            'uuid'         => $id, 'telematic_uuid' => $telematic->uuid, 'run_uuid' => $run,
+            'source'       => $source, 'status' => 'pending', 'payload_hash' => hash('sha256', $json),
+            'payload'      => Crypt::encryptString($json), 'received_at' => $receivedAt ?? now()->utc()->toDateTimeString(),
+            'available_at' => now(), 'created_at' => now(), 'updated_at' => now(),
+        ]);
+        // The scheduled drain also dispatches pending records if the broker is unavailable.
+        try {
+            Queue::dispatch((new ProcessTelematicDelivery($id))->onQueue(Configuration::forConnection($telematic)['ingestion_queue'] ?? 'default'));
+        } catch (\Throwable) {
+            // Durable acceptance succeeded. The payload must not be logged here.
+        }
+
+        return $id;
+    }
+
+    public static function enabled(Telematic $telematic): bool
+    {
+        return (bool) $telematic->company_uuid
+            && in_array($telematic->status, ['active', 'connected', 'error', 'synchronizing'], true)
+            && data_get($telematic->meta, 'telemetry_sync_enabled', true) !== false;
+    }
+
+    public static function finishRun(?string $id): void
+    {
+        if (!$id) {
+            return;
+        }
+        DB::transaction(function () use ($id) {
+            $run = DB::table('telematic_sync_runs')->where('uuid', $id)->lockForUpdate()->first();
+            if (!$run || $run->status === 'fetching') {
+                return;
+            }
+            $items = DB::table('telematic_deliveries')->where('run_uuid', $id);
+            if ((clone $items)->whereIn('status', ['pending', 'processing', 'retry'])->exists()) {
+                return;
+            }
+            $failed = (clone $items)->sum('failed');
+            DB::table('telematic_sync_runs')->where('uuid', $id)->update([
+                'status'  => $run->status === 'incomplete' ? 'incomplete' : ($failed ? 'partial' : 'completed'),
+                'applied' => (clone $items)->sum('applied'), 'failed' => $failed, 'updated_at' => now(),
+            ]);
+        });
+    }
+}

package/server/src/Support/Telematics/Telemetry/Ingestor.php

@@ -0,0 +1,112 @@
+<?php
+
+namespace Fleetbase\FleetOps\Support\Telematics\Telemetry;
+
+use Fleetbase\FleetOps\Contracts\TelemetryProviderInterface;
+use Fleetbase\FleetOps\Events\DeviceTelemetryUpdated;
+use Fleetbase\FleetOps\Models\Device;
+use Fleetbase\FleetOps\Models\DeviceEvent;
+use Fleetbase\FleetOps\Models\Telematic;
+use Fleetbase\FleetOps\Support\Telematics\TelematicService;
+use Illuminate\Support\Carbon;
+use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Facades\DB;
+
+class Ingestor
+{
+    public function ingest(Telematic $telematic, TelemetryProviderInterface $provider, array $raw, TelematicService $service, ?string $receivedAt = null, string $source = 'poll'): array
+    {
+        $sample                = $provider->normalizeTelemetrySnapshot($raw);
+        $normalized            = $sample['device'];
+        $event                 = $sample['event'];
+        $event['occurred_at']  = Sample::timestamp($event['occurred_at'] ?? null);
+        $event['last_seen_at'] = Sample::timestamp($event['last_seen_at'] ?? $event['occurred_at']);
+        $event['ignition'] ??= null;
+        $normalized['last_seen_at']       = Sample::timestamp($normalized['last_seen_at'] ?? $event['last_seen_at']);
+        $options                          = Configuration::options($provider);
+        $normalized['_ordered_telemetry'] = true;
+        $event['_ordered_telemetry']      = true;
+        $id                               = $normalized['device_id'] ?? null;
+        if (!$id) {
+            throw new \InvalidArgumentException('Unit identity is required.');
+        }
+        $key = 'telemetry:device:' . hash('sha256', $telematic->uuid . '|' . $id);
+
+        return Cache::lock($key, 60)->block(5, fn () => DB::transaction(function () use ($telematic, $sample, $options, $service, $receivedAt, $source, $normalized, $event, $id) {
+            $device            = Device::withoutGlobalScopes()->where('company_uuid', $telematic->company_uuid)->where('telematic_uuid', $telematic->uuid)->where('device_id', $id)->lockForUpdate()->first();
+            $current           = data_get($device?->meta, 'telemetry.position_at') ?? data_get($device?->meta, 'last_update.occurred_at');
+            $valid             = Sample::validPosition($event);
+            $newer             = $valid && (!$current || Carbon::parse($event['occurred_at'])->gt(Carbon::parse($current)));
+            $event['event_id'] = Sample::signalKey($event);
+            // Same identity as TelematicService::makeEventKey, serialized under the device lock.
+            $eventKey  = sha1(implode('|', [$telematic->provider, $telematic->public_id ?? $telematic->uuid, $id, $event['event_id'], $event['event_type'], $event['occurred_at']]));
+            $duplicate = $valid && DeviceEvent::withoutGlobalScopes()->where('_key', $eventKey)->exists();
+            $received  = Sample::timestamp($receivedAt ?? now()->toISOString());
+            $meta      = array_filter([
+                'position_at'          => $event['occurred_at'], 'provider_at' => data_get($event, 'meta.telemetry.provider_at'),
+                'received_at'          => $received, 'processed_at' => now()->toISOString(), 'source' => $source,
+                'queue_delay_seconds'  => max(0, now()->timestamp - Carbon::parse($received)->timestamp),
+                'source_delay_seconds' => $event['occurred_at'] ? max(0, Carbon::parse($received)->timestamp - Carbon::parse($event['occurred_at'])->timestamp) : null,
+                'ignition'             => $event['ignition'],
+            ], fn ($value) => $value !== null);
+            $ignition                    = $event['ignition'] ?? data_get($device?->meta, 'telemetry.ignition');
+            $meta['stale_after_seconds'] = (int) ($options[$ignition === true ? 'stale_engine_on_seconds' : 'stale_engine_off_seconds'] ?? ($ignition === true ? 120 : 600));
+            if (!$device || $newer) {
+                $contactAt = $normalized['last_seen_at'] ?? null;
+                if ($contactAt && Carbon::parse($contactAt)->gt(now()->addMinutes(5))) {
+                    $contactAt = null;
+                }
+                if ($device?->last_online_at && (!$contactAt || Carbon::parse($contactAt)->lt($device->last_online_at))) {
+                    $contactAt = $device->last_online_at->toISOString();
+                }
+                $normalized['last_seen_at'] = $contactAt;
+                if (!$valid) {
+                    unset($normalized['location'], $normalized['meta']['last_update']);
+                }
+                $normalized['meta'] = array_replace_recursive($device?->meta ?? [], $normalized['meta'] ?? []);
+                if ($newer) {
+                    $normalized['meta']['telemetry'] = array_replace(data_get($device?->meta, 'telemetry', []), $meta);
+                }
+                $normalized['meta'] = array_replace_recursive($device?->meta ?? [], array_filter($normalized['meta'], fn ($v) => $v !== null));
+                $device             = $service->linkDevice($telematic, $normalized);
+            }
+            // Last contact can advance independently of an old/repeated GPS fix.
+            $contactChanged = false;
+            $contact        = $event['last_seen_at'];
+            if ($contact && Carbon::parse($contact)->lte(now()->addMinutes(5)) && (!$device->last_online_at || Carbon::parse($contact)->gt($device->last_online_at))) {
+                $device->last_online_at = Carbon::parse($contact)->utc()->toDateTimeString();
+                $device->online         = $device->last_online_at->gt(now()->subMinutes(10));
+                if (in_array($device->status, ['online', 'recently_offline', 'offline', 'long_offline', 'never_connected'], true)) {
+                    $minutes        = $device->last_online_at->diffInMinutes(now());
+                    $device->status = $minutes <= 10 ? 'online' : ($minutes <= 60 ? 'recently_offline' : ($minutes <= 1440 ? 'offline' : 'long_offline'));
+                }
+                $device->meta           = array_replace_recursive($device->meta ?? [], ['telemetry' => ['provider_at' => $contact, 'last_received_at' => $received]]);
+                $device->save();
+                $contactChanged = true;
+            }
+            $stored = null;
+            if ($valid && !$duplicate) {
+                $event['_history_only']     = !$newer;
+                $event['meta']['telemetry'] = $meta;
+                // Do not replace the higher contact watermark with delayed transmission time.
+                $event['last_seen_at'] = $device->last_online_at?->toISOString();
+                $stored                = $service->storeDeviceEvent($telematic, $event, $device);
+            }
+            $sensors    = 0;
+            foreach ($sample['sensors'] ?? [] as $sensor) {
+                $sensor['_ordered_telemetry'] = true;
+                if (!$sensor['recorded_at'] || Carbon::parse($sensor['recorded_at'])->gt(now()->addMinutes(5))) {
+                    continue;
+                }
+                $service->storeSensor($telematic, $sensor, $device);
+                $sensors++;
+            }
+            if ($newer || $contactChanged) {
+                $snapshot = $device->fresh() ?? $device;
+                DB::afterCommit(fn () => broadcast(new DeviceTelemetryUpdated($snapshot)));
+            }
+
+            return ['device' => $device, 'event' => $stored, 'events' => $stored ? [$stored] : [], 'sensors' => $sensors, 'duplicate' => $duplicate, 'invalid_position' => !$valid];
+        }, 3));
+    }
+}

package/server/src/Support/Telematics/Telemetry/Queue.php

@@ -0,0 +1,28 @@
+<?php
+
+namespace Fleetbase\FleetOps\Support\Telematics\Telemetry;
+
+use Illuminate\Bus\UniqueLock;
+use Illuminate\Contracts\Bus\Dispatcher;
+use Illuminate\Contracts\Queue\ShouldBeUnique;
+use Illuminate\Support\Facades\Cache;
+
+class Queue
+{
+    /** Unlike PendingDispatch, release the uniqueness lease when broker dispatch fails. */
+    public static function dispatch(ShouldBeUnique $job): bool
+    {
+        $lock = new UniqueLock(Cache::store());
+        if (!$lock->acquire($job)) {
+            return false;
+        }
+        try {
+            app(Dispatcher::class)->dispatch($job);
+
+            return true;
+        } catch (\Throwable $e) {
+            $lock->release($job);
+            throw $e;
+        }
+    }
+}

package/server/src/Support/Telematics/Telemetry/Sample.php

@@ -0,0 +1,54 @@
+<?php
+
+namespace Fleetbase\FleetOps\Support\Telematics\Telemetry;
+
+use Illuminate\Support\Carbon;
+
+/** Normalized telemetry validation and cross-transport signal identity. */
+class Sample
+{
+    public static function timestamp(mixed $value): ?string
+    {
+        if ($value === null || $value === '' || is_bool($value) || (!is_string($value) && !is_numeric($value))) {
+            return null;
+        }
+        try {
+            $time = is_numeric($value)
+                ? Carbon::createFromTimestampUTC((float) $value > 9999999999 ? (float) $value / 1000 : (float) $value)
+                : Carbon::parse($value, 'UTC')->utc();
+
+            return $time->toISOString();
+        } catch (\Throwable) {
+            return null;
+        }
+    }
+
+    public static function validPosition(array $event): bool
+    {
+        $lat  = data_get($event, 'location.lat');
+        $lng  = data_get($event, 'location.lng');
+        $time = self::timestamp($event['occurred_at'] ?? null);
+
+        return is_numeric($lat) && is_numeric($lng) && is_finite((float) $lat) && is_finite((float) $lng)
+            && $lat >= -90 && $lat <= 90 && $lng >= -180 && $lng <= 180
+            && $time !== null && Carbon::parse($time)->lte(now()->addMinutes(5));
+    }
+
+    public static function signalKey(array $event): string
+    {
+        // Receipt/source/envelope differences must not change identity across poll and push.
+        $signal = array_intersect_key($event, array_flip(['device_id', 'occurred_at', 'event_type', 'location', 'speed', 'heading', 'altitude', 'ignition']));
+        ksort($signal);
+        if (isset($signal['location'])) {
+            $signal['location'] = array_map(fn ($v) => $v === null ? null : (float) $v, $signal['location']);
+            ksort($signal['location']);
+        }
+        foreach (['speed', 'heading', 'altitude'] as $field) {
+            if (isset($signal[$field])) {
+                $signal[$field] = (float) $signal[$field];
+            }
+        }
+
+        return hash('sha256', json_encode($signal, JSON_THROW_ON_ERROR | JSON_PRESERVE_ZERO_FRACTION));
+    }
+}

package/server/src/routes.php

@@ -14,6 +14,18 @@ use Illuminate\Support\Facades\Route;
 */
 Route::prefix(config('fleetops.api.routing.prefix'))->namespace('Fleetbase\FleetOps\Http\Controllers')->group(
     function ($router) {
+        // Tokenised inspection links, for people with no console login. The
+        // link itself is the credential, so what guards it lives here: a rate
+        // limit per address on every call, and a tighter one on uploads. Each
+        // limiter has its own prefix so the two do not share one counter.
+        // Every answer is JSON, so a refused submission reaches the page with
+        // its reasons instead of as a redirect back to it.
+        $router->prefix('public')->namespace('Public')->middleware([Fleetbase\FleetOps\Http\Middleware\ForceJsonResponse::class, 'throttle:60,1,inspection-public'])->group(function ($router) {
+            $router->get('inspections/forms/{id}', 'PublicInspectionController@show');
+            $router->post('inspections/forms/{id}/submit', 'PublicInspectionController@submit');
+            $router->post('inspections/forms/{id}/files', 'PublicInspectionController@upload')->middleware('throttle:20,1,inspection-upload');
+        });
+
         /*
         |--------------------------------------------------------------------------
         | Consumable FleetOps API Routes
@@ -207,6 +219,20 @@ Route::prefix(config('fleetops.api.routing.prefix'))->namespace('Fleetbase\Fleet
                 $router->patch('{id}', 'ManifestController@updateStop');
                 $router->post('{id}', 'ManifestController@updateStop');
             });
+            // inspections — a driver's DVIR. Read the published forms and file
+            // against them; authoring forms and reviewing submissions is fleet
+            // management and stays on the internal namespace. A refused submit
+            // answers 422 in JSON: without ForceJsonResponse, a client that did
+            // not ask for JSON was redirected instead.
+            $router->group(['prefix' => 'inspection-forms', 'middleware' => [Fleetbase\FleetOps\Http\Middleware\ForceJsonResponse::class]], function () use ($router) {
+                $router->get('/', 'InspectionController@queryForms');
+                $router->get('{id}', 'InspectionController@findForm');
+            });
+            $router->group(['prefix' => 'inspections', 'middleware' => [Fleetbase\FleetOps\Http\Middleware\ForceJsonResponse::class]], function () use ($router) {
+                $router->post('/', 'InspectionController@submit');
+                $router->get('/', 'InspectionController@query');
+                $router->get('{id}', 'InspectionController@find');
+            });
 
             // entities routes
             $router->group(['prefix' => 'entities'], function () use ($router) {
@@ -300,6 +326,8 @@ Route::prefix(config('fleetops.api.routing.prefix'))->namespace('Fleetbase\Fleet
                 $router->delete('{id}', 'VehicleController@delete');
                 $router->match(['put', 'patch', 'post'], '{id}/track', 'VehicleController@track');
                 $router->get('{id}/trailers', 'TrailerController@vehicleTrailers');
+                // A vehicle's inspection history, for the driver app's vehicle screen.
+                $router->get('{id}/inspections', 'InspectionController@forVehicle')->middleware(Fleetbase\FleetOps\Http\Middleware\ForceJsonResponse::class);
             });
             // trailer routes
             $router->group(['prefix' => 'trailers'], function () use ($router) {
@@ -449,6 +477,7 @@ Route::prefix(config('fleetops.api.routing.prefix'))->namespace('Fleetbase\Fleet
                             function ($router, $controller) {
                                 $router->get('providers', $controller('providers'));
                                 $router->post('providers/{provider}/test-credentials', $controller('testCredentials'));
+                                $router->get('{id}/activity', $controller('activity'));
                                 $router->post('{id}/test-connection', $controller('testConnection'));
                                 $router->post('{id}/sync', $controller('sync'));
                             }
@@ -630,6 +659,9 @@ Route::prefix(config('fleetops.api.routing.prefix'))->namespace('Fleetbase\Fleet
                             $router->get('{id}/devices', $controller('devices'));
                             $router->post('{id}/link-device', $controller('linkDevice'));
                             $router->post('{id}/discover', $controller('discover'));
+                            $router->get('{id}/telemetry-diagnostics', $controller('telemetryDiagnostics'));
+                            $router->post('{id}/telemetry-webhook', $controller('telemetryWebhook'));
+                            $router->post('{id}/telemetry-deliveries/{delivery}/replay', $controller('replayTelemetryDelivery'));
                             $router->post('{id}/test-connection', $controller('testConnection'));
                             $router->post('{key}/test-credentials', $controller('testCredentials'));
                         });
@@ -642,6 +674,26 @@ Route::prefix(config('fleetops.api.routing.prefix'))->namespace('Fleetbase\Fleet
                             $router->get('calendar-feed', $controller('calendarFeed'));
                             $router->get('{id}/ical', $controller('ical'));
                         });
+                        // The console validates these with $request->validate(), which
+                        // redirects a request that did not ask for JSON; they answer
+                        // in JSON so a refusal reaches the console as a 422.
+                        $router->group(['middleware' => [Fleetbase\FleetOps\Http\Middleware\ForceJsonResponse::class]], function ($router) {
+                            $router->fleetbaseRoutes('inspection-forms', function ($router, $controller) {
+                                $router->post('{id}/publish', $controller('publish'));
+                                $router->post('{id}/archive', $controller('archive'));
+                                $router->post('{id}/generate-link', $controller('generateLink'));
+                                $router->get('{id}/links', $controller('links'));
+                                $router->delete('{id}/links/{linkId}', $controller('revokeLink'));
+                                $router->post('{id}/links/{linkId}/send-pin', $controller('sendPin'));
+                            });
+                            $router->fleetbaseRoutes('inspection-submissions', function ($router, $controller) {
+                                $router->match(['get', 'post'], 'export', $controller('export'));
+                                $router->post('{id}/submit', $controller('submit'));
+                                $router->post('{id}/create-issue', $controller('createIssue'));
+                                $router->post('{id}/create-work-order', $controller('createWorkOrder'));
+                                $router->post('{id}/resolve', $controller('resolve'));
+                            });
+                        });
                         $router->fleetbaseRoutes('work-orders', function ($router, $controller) {
                             $router->match(['get', 'post'], 'export', $controller('export'));
                             $router->post('import', $controller('import'));
@@ -789,6 +841,30 @@ Route::prefix(config('fleetops.api.routing.prefix'))->namespace('Fleetbase\Fleet
                                         $router->get('maintenance', 'HubController@maintenance');
                                     }
                                 );
+
+                                // radar — the per-record gaps a fleet manager triages each
+                                // morning, computed live, with acknowledge / snooze / assign
+                                // state kept on the core alerts table.
+                                $router->group(
+                                    ['prefix' => 'radar'],
+                                    function ($router) {
+                                        $router->get('items', 'RadarController@items');
+                                        $router->get('summary', 'RadarController@summary');
+                                        $router->get('briefing', 'RadarController@briefing');
+                                        $router->get('agenda', 'RadarController@agenda');
+                                        $router->get('handovers/{key}', 'RadarController@handoverSuggest');
+                                        $router->post('shifts/{id}/extend', 'RadarController@extendShift');
+                                        $router->post('items/bulk', 'RadarController@bulk');
+                                        $router->post('items/{key}/acknowledge', 'RadarController@acknowledge');
+                                        $router->post('items/{key}/snooze', 'RadarController@snooze');
+                                        $router->post('items/{key}/wake', 'RadarController@wake');
+                                        $router->post('items/{key}/assign', 'RadarController@assign');
+                                        $router->post('items/{key}/plan', 'RadarController@plan');
+                                        $router->post('items/{key}/resolve', 'RadarController@resolve');
+                                        $router->post('notices', 'RadarController@storeNotice');
+                                        $router->delete('notices/{id}', 'RadarController@destroyNotice');
+                                    }
+                                );
                                 $router->group(
                                     ['prefix' => 'getting-started'],
                                     function ($router) {

package/server/tests/ApiManifestControllerContractsTest.php

@@ -84,8 +84,8 @@ use Illuminate\Http\Request;
 /** A stop that records what was done to it instead of touching a database. */
 class FleetOpsManifestStopFake extends ManifestStop
 {
-    public array $marks   = [];
-    public array $updates = [];
+    public array $marks          = [];
+    public array $updates        = [];
     public ?object $placeForTest = null;
 
     public function markArrived(): ManifestStop
@@ -148,7 +148,7 @@ class FleetOpsManifestStopFake extends ManifestStop
 /** A manifest whose stops and appended counts are supplied, not queried. */
 class FleetOpsManifestFakeRecord extends Manifest
 {
-    public $stopsForTest = null;
+    public $stopsForTest;
 
     public function getCompletedStopsAttribute(): int
     {
@@ -263,7 +263,7 @@ class FleetOpsManifestQueryFake
         return $this;
     }
 
-    public function get(): \Illuminate\Support\Collection
+    public function get(): Illuminate\Support\Collection
     {
         return collect($this->results);
     }
@@ -451,7 +451,7 @@ test('manifest controller re-sequences pending stops nearest first, leaving fini
 
     $manifest               = new FleetOpsManifestFakeRecord();
     $manifest->setRawAttributes(['uuid' => 'm-uuid', 'public_id' => 'manifest_a'], true);
-    $manifest->stopsForTest = collect([$done, $far, $near, $mid]);
+    $manifest->stopsForTest                    = collect([$done, $far, $near, $mid]);
     FleetOpsManifestControllerProbe::$manifest = $manifest;
 
     FleetOpsManifestControllerProbe::$distances = [
@@ -482,8 +482,8 @@ test('manifest controller starts from the first pending stop when given no posit
 
     $manifest               = new FleetOpsManifestFakeRecord();
     $manifest->setRawAttributes(['uuid' => 'm-uuid', 'public_id' => 'manifest_a'], true);
-    $manifest->stopsForTest = collect([$a, $b, $c]);
-    FleetOpsManifestControllerProbe::$manifest = $manifest;
+    $manifest->stopsForTest                     = collect([$a, $b, $c]);
+    FleetOpsManifestControllerProbe::$manifest  = $manifest;
     FleetOpsManifestControllerProbe::$distances = [
         '1.3,103.8->1.3,103.8'   => 0.0,
         '1.3,103.8->1.31,103.81' => 1500.0,
@@ -506,7 +506,7 @@ test('manifest controller skips a stop with no place rather than failing the who
 
     $manifest               = new FleetOpsManifestFakeRecord();
     $manifest->setRawAttributes(['uuid' => 'm-uuid', 'public_id' => 'manifest_a'], true);
-    $manifest->stopsForTest = collect([$a, $b, $c]);
+    $manifest->stopsForTest                    = collect([$a, $b, $c]);
     FleetOpsManifestControllerProbe::$manifest = $manifest;
 
     $controller = new FleetOpsManifestControllerProbe();
@@ -585,7 +585,7 @@ test('manifest controller lookups go to the database', function () {
     $reached = function (callable $lookup): bool {
         try {
             $lookup();
-        } catch (\Throwable $e) {
+        } catch (Throwable $e) {
             return true;
         }
 

package/server/tests/ControllerFilterContractsTest.php

@@ -741,7 +741,7 @@ test('fuel provider and work order filters record company search and status scop
         ['where', ['company_uuid', 'company-uuid']],
         ['search', 'fuelx'],
         ['where', ['provider', 'petro-app']],
-        ['where', ['status', 'active']],
+        ['whereIn', 'status', ['active']],
         ['where', ['environment', 'sandbox']],
     ]);
 

package/server/tests/EventContractsTest.php

@@ -477,13 +477,14 @@ test('driver simulated location changed broadcasts simulated telemetry payload',
 
 test('vehicle location changed broadcasts vehicle telemetry payload', function () {
     session([
-        'company'        => 'company-1',
+        'company'        => 'wrong-session-company',
         'api_credential' => 'api-1',
     ]);
 
     $vehicle = new Vehicle();
     $vehicle->setRawAttributes([
         'uuid'         => 'vehicle-uuid',
+        'company_uuid' => 'company-1',
         'public_id'    => 'vehicle_public',
         'plate_number' => 'ABC-123',
         'name'         => 'Truck 12',