Opensalestax Laravel Package

Minor bump: adopts the engine's top-level shipping field on POST /v1/calculate (engine v0.59.0+). Mirrors opensalestax-js v0.3.0 on the PHP side. Backward compatible — existing two-arg callers of calculate() continue unchanged.

Added

• Shipping value object (request-side) with optional method, separatelyStated, isHandlingCharge flags.
• CalculatedShipping DTO (response-side) under OpenSalesTax\Responses\.
• Third arg ?Shipping $shipping = null on Client::calculate().
• CalculateResponse::$shipping (CalculatedShipping|null).
• CalculateResponse::$coverageWarning (string|null) — engine v0.59.0+ surfaces coverage warnings when rate data is incomplete.
• New ShippingTest + calculate-mn-shipping.json fixture captured from the live engine on 2026-05-19 (MN $100 + $12.50 shipping → $9.0250 line tax + $1.1281 shipping tax).

Notes

• Engine v0.59.0+ required for the engine to actually calculate shipping. Older engines silently ignore the field; the response's shipping will be null. Connectors should flag-gate on $client->capabilities()->features->shippingFirstClass if they need to detect this at setup time.

Minor bump: adopts the engine's new GET /v1/capabilities endpoint shipped in engine v0.59.0. Connectors can query engine capabilities at setup time + gate feature-flagged code paths on a single fetch.

Added

• Client::capabilities() and Client::capabilitiesCached() — GET /v1/capabilities; per-instance memoization on the cached variant.
• CapabilitiesResponse / CapabilityEndpoint / CapabilityFeatures DTOs under OpenSalesTax\Responses\.
• CapabilityFeatures::$extras — preserves any future engine feature flags the SDK doesn't yet have typed slots for. Forward-compatible by design.
• Client::MIN_ENGINE_VERSION constant ('0.59.0') — for connector tier code that wants to surface a clear "engine too old" error at setup time.

Added

• SECURITY.md (vulnerability reporting + threat model + 90-day disclosure window). Packagist-published packages should have one; stranger readers expect to find a security email.

Changed

• README quickstart class name reconciled: new OpenSalesTaxClient(...) → new OpenSalesTax\Client(...) to match the actual namespaced class.
• Earlier CHANGELOG line claiming the CI matrix was "PHP 8.1 / 8.2 / 8.3" corrected to "PHP 8.2 / 8.3 / 8.4" (composer.json has always required PHP >=8.2; 8.1 was never in the matrix).

Notes

• No code changes; no API surface changes. v0.1.0 consumers can upgrade with no migration.
• This release cleans up the documentation surface so packagist.org strangers see consistent + complete docs.

Added

• Initial v0.1 alpha against engine v0.14.0
• OpenSalesTax\Client wrapping /v1/health, /v1/states, /v1/rates, /v1/calculate
• Request DTOs: Address, LineItem (PHP 8.1 readonly classes)
• Response DTOs: HealthResponse, StatesResponse, StateInfo, RatesResponse, CalculateResponse, CalculatedLine, JurisdictionRate
• Exceptions: OpenSalesTaxException (base), OpenSalesTaxApiException, OpenSalesTaxNetworkException, OpenSalesTaxValidationException
• PSR-18 HTTP client interface (default Guzzle 7; injectable)
• X-API-Key header auth (optional)
• Decimal-string amount handling (no float / cents conversion)
• PHPUnit test suite with fixture-based unit tests + gated live-engine integration tests
• GitHub Actions CI on PHP 8.2 / 8.3 / 8.4