chore: prepare notification-contract 0.0.4

README.md

@@ -2,7 +2,7 @@
 
 Shared contracts and runtime libraries for CommerceKit GitHub Actions. This public repository is a pnpm monorepo, not a GitHub Marketplace Action. There is no root `action.yml`.
 
-The source manifests prepare `0.0.3` for both packages under the `preview` dist-tag; the last verified publication is `0.0.2`. APIs remain pre-1.0; verify registry publication before installation. Placeholder reserved versions, if published later, are not supported dependencies.
+The source manifests prepare `notification-contract@0.0.4` and `ccv2-client@0.0.3` under the `preview` dist-tag. Source versions are not registry publication evidence. APIs remain pre-1.0; verify registry publication before installation. Placeholder reserved versions, if published later, are not supported dependencies.
 
 | Package                                    | Responsibility                                                                                | Consumers                                                                      |
 | ------------------------------------------ | --------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------ |

RELEASING.md

@@ -6,7 +6,7 @@ Nothing is published by a feature PR or ordinary CI. Package versions are immuta
 2. Verify main CI and CodeQL.
 3. Optionally dispatch `reserve-package-names` with confirmation `RESERVE-COMMERCEKIT-PACKAGES`. It publishes only temporary unsupported `0.0.0-reserved.1` packages under `reserved`, never source implementations or `preview`/`latest`. Both versions are checked absent before publishing. If one succeeds and the second fails, stop for owner review rather than bypassing immutability checks.
 4. Configure public visibility, repository association and Actions read access using the [package access checklist](docs/github-packages.md#package-access).
-5. Prepare a selected-package version/changelog PR. Source manifests currently prepare `0.0.3` for both packages; the last verified publication is `0.0.2`. Source versions are not publication evidence.
+5. Prepare a selected-package version/changelog PR. Source manifests currently prepare `notification-contract@0.0.4` and `ccv2-client@0.0.3`. Source versions are not registry publication evidence. Source versions are not publication evidence.
 6. Merge the reviewed version PR.
 7. Dispatch `publish-package`: package `notification-contract` or `ccv2-client`, channel `preview` or `stable`, exact confirmation `PUBLISH-COMMERCEKIT-PREVIEW` or `PUBLISH-COMMERCEKIT-STABLE`. Preview accepts nonzero `0.x.y` initial releases (including `0.0.1`) or `0.x.y-preview.n`; stable requires 1.0.0 or later without prerelease. The workflow checks version absence and successful CI/CodeQL for the exact main commit, runs full quality and the selected pack/install checks, and verifies clean generated files. It retains the tested tarball in runner temporary storage, verifies its SHA-256 immediately before publication, and publishes those exact bytes with `preview` or `latest` and lifecycle scripts disabled. No source-directory repack or artifact upload is involved.
 8. Verify the exact package version in GitHub Packages and its visibility/access.

compatibility/tests/release-safety.test.mjs

@@ -5,9 +5,12 @@ import { mkdtempSync, readFileSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 it('publication requires exact package/channel/confirmation and pre-1.0 version', () => {
-  for (const name of ['notification-contract', 'ccv2-client'])
+  for (const [name, version] of [
+    ['notification-contract', '0.0.4'],
+    ['ccv2-client', '0.0.3'],
+  ])
     expect(releasePlan(name, 'preview', 'PUBLISH-COMMERCEKIT-PREVIEW')).toMatchObject({
-      version: '0.0.3',
+      version,
       tag: 'preview',
     });
   for (const args of [

docs/github-packages.md

@@ -2,7 +2,7 @@
 
 This is the configuration checklist for future package releases and consumer updates. The release sequence, dispatch confirmations and recovery steps live in [RELEASING.md](../RELEASING.md).
 
-Packages use `https://npm.pkg.github.com` and are associated with public source repository `commercekit-tools/action-kit`. Source visibility does not prove package visibility, access or publication. The current source prepares `0.0.3`; verify registry availability before consumer installation.
+Packages use `https://npm.pkg.github.com` and are associated with public source repository `commercekit-tools/action-kit`. Source visibility does not prove package visibility, access or publication. The current source prepares notification-contract `0.0.4` and ccv2-client `0.0.3`; verify registry availability before consumer installation.
 
 ## Publishing repository
 
@@ -57,7 +57,7 @@ steps:
       NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 ```
 
-Pin exact versions only after they are published and accessible. For the prepared release, Notify needs `@commercekit-tools/notification-contract` at `0.0.3`; Build and Deploy need both packages at `0.0.3`. Regenerate and commit each consumer's lockfile and standalone Action bundle using its documented commands, then run its complete quality gate before pushing. Avoid dependency ranges, local links, git dependencies or copied library source in released Actions.
+Pin exact versions only after they are published and accessible. For the prepared release, Notify needs `@commercekit-tools/notification-contract` at `0.0.4` for cleanup events; Build and Deploy continue to use both packages at `0.0.3` until separately migrated. Regenerate and commit each consumer's lockfile and standalone Action bundle using its documented commands, then run its complete quality gate before pushing. Avoid dependency ranges, local links, git dependencies or copied library source in released Actions.
 
 Users running an already bundled Action do not need package registry credentials. Package authentication is needed when installing dependencies to develop or rebuild it.
 

packages/notification-contract/CHANGELOG.md

@@ -1,5 +1,11 @@
 # notification-contract changelog
 
+## 0.0.4
+
+Add the provider-neutral `ccv2.build-cleanup.completed` event, `BuildCleanupEvent`/`BuildCleanupEventData` public types, shared schema validation and `createBuildCleanupEvent` factory. Cleanup data reports dry-run/apply mode, exact scope, combined retention settings, bounded outcome counts and duration using the existing completed-status vocabulary. Accepted deletion requests are distinct from physical removal. Existing events, schema version 1, sanitizers and factory semantics are preserved.
+
+Prepared for exact-version preview integration with Notify; the consumer must use a compatible cleanup renderer. Package publication is separate from tags/GitHub Releases and does not authorize SAP deletion. Packed-install validation now exercises cleanup imports, validation and declarations through public exports.
+
 ## 0.0.3
 
 Add opt-in `stripAngleBracketText` and `redactJwtLikeTokens` primitives extracted from Build/Deploy. JWT-shaped redaction uses a linear word-run scan to avoid the copied regex's quadratic behavior on repeated prefixes. Existing sanitizers, redaction order, event factories and schema are unchanged. Prepared for preview publication; consumer migrations must verify registry availability before installation.

packages/notification-contract/README.md

@@ -2,7 +2,7 @@
 
 Provider-neutral NotificationEvent v1 types, schema and validation for Notify, Build, Deploy, future Check and reusable workflows. No CCv2 calls, CLI diagnostics, Action I/O, polling, provider rendering or webhook delivery.
 
-Public exports: `NotificationEvent`, `NotificationStatus`, `NotificationEventType`, `NotificationSource`, `NotificationContext`, `NotificationLink`, `SafeNotificationError`, `CheckEventData`, `BuildEventData`, `DeploymentEventData`; `validateNotificationEvent`, `parseNotificationEventJson`, `validateNotificationLink`, `validateGitHubRunUrl`, `extractSafeGitHubContext`, `mergeProducerContext`, `mergeNotifierContext`, `createCheckEvent`, `createBuildEvent`, `createDeploymentEvent`, `redactKnownSecrets`, `sanitizeBoundedText`, `sanitizeLabel`, `sanitizeErrorMessage`.
+Public exports: `NotificationEvent`, `NotificationStatus`, `NotificationEventType`, `NotificationSource`, `NotificationContext`, `NotificationLink`, `SafeNotificationError`, `CheckEventData`, `BuildEventData`, `DeploymentEventData`, `BuildCleanupEvent`, `BuildCleanupEventData`; `validateNotificationEvent`, `parseNotificationEventJson`, `validateNotificationLink`, `validateGitHubRunUrl`, `extractSafeGitHubContext`, `mergeProducerContext`, `mergeNotifierContext`, `createCheckEvent`, `createBuildEvent`, `createDeploymentEvent`, `createBuildCleanupEvent`, `redactKnownSecrets`, `sanitizeBoundedText`, `sanitizeLabel`, `sanitizeErrorMessage`.
 
 ```ts
 import { createCheckEvent, parseNotificationEventJson } from '@commercekit-tools/notification-contract';
@@ -22,7 +22,7 @@ Extraction reads only approved runner fields, never event payloads. Explicit pro
 
 Install from GitHub Packages after a supported version is published. Configure `@commercekit-tools:registry=https://npm.pkg.github.com`; local users need a classic PAT with `read:packages` in user-level configuration. Consumer Actions need package Actions read access and `GITHUB_TOKEN` with `packages: read`. See the repository authentication guide. Pin exact versions, never ranges.
 
-Source version: `0.0.3`, prepared for pre-1.0 integration under the `preview` dist-tag. This manifest is not publication evidence. Verify registry availability before installation and pin `0.0.3` exactly. Stable API and coordinated consumer/Sandbox validation remain future gates. Reservation versions are unsupported.
+Source version: `0.0.4`, prepared for pre-1.0 integration under the `preview` dist-tag. This manifest is not publication evidence. Verify registry availability before installation and pin `0.0.4` exactly. Stable API and coordinated consumer/Sandbox validation remain future gates. Reservation versions are unsupported.
 
 Independent package SemVer applies; stable breaking changes require a major increment. NotificationEvent schema version is separate from package version. Preserve current consumer contracts during migration. No telemetry or logging is performed. Use synthetic tests and register exact runtime secrets; pattern redaction cannot identify all secrets.
 
@@ -34,13 +34,14 @@ The first removes angle brackets and all text between each opening bracket and t
 
 These are opt-in primitives: existing sanitizers/factories do not call them automatically. Consumers retain secret registration, ordering, text bounds, fallback labels and provider escaping. See the [remaining extraction audit](../../docs/remaining-extraction-audit.md) for compatibility evidence and rollout.
 
-## Candidate cleanup event (unpublished)
+## Build cleanup event added in 0.0.4
 
 `createBuildCleanupEvent` creates `ccv2.build-cleanup.completed`. Its data contains
 mode, scope, retention policy, outcome, bounded counts, duration, and an optional
 safe error. A successful `deletionRequestedCount` represents accepted deletion
 initiation, never confirmed physical removal. Status uses the existing completed
 status vocabulary. Producers must sanitize identifiers and errors before creating
-an event. This additive candidate requires a compatible notify renderer; notify
-versions using the published 0.0.3 contract reject this new event. Publication and
-consumer pin updates require separate authorization.
+an event. This additive event requires a compatible Notify renderer. Consumers using
+published 0.0.3 or older reject it. Verify 0.0.4 registry availability and the
+matching Notify revision before enabling this integration; a source manifest
+is not publication evidence.

packages/notification-contract/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@commercekit-tools/notification-contract",
-  "version": "0.0.3",
+  "version": "0.0.4",
   "description": "Provider-neutral NotificationEvent v1 contracts and factories.",
   "license": "MIT",
   "type": "module",

scripts/pack-and-test.mjs

@@ -57,10 +57,10 @@ try {
   const types = [];
   if (!selected || selected === 'notification-contract') {
     smoke.push(
-      `import {createCheckEvent,validateNotificationEvent,stripAngleBracketText,redactJwtLikeTokens} from '@commercekit-tools/notification-contract'; import schema from '@commercekit-tools/notification-contract/schema' with {type:'json'}; if(stripAngleBracketText('a<b>c')!=='ac'||redactJwtLikeTokens('eyJheader.payload.signature')!=='[REDACTED]')throw Error('Packed text primitives'); if(schema.properties.schemaVersion.const!==1)throw Error('Schema export'); validateNotificationEvent(createCheckEvent({status:'success',data:{filesChecked:1,errors:0,warnings:0}}));`,
+      `import {createCheckEvent,createBuildCleanupEvent,validateNotificationEvent,stripAngleBracketText,redactJwtLikeTokens} from '@commercekit-tools/notification-contract'; import schema from '@commercekit-tools/notification-contract/schema' with {type:'json'}; if(stripAngleBracketText('a<b>c')!=='ac'||redactJwtLikeTokens('eyJheader.payload.signature')!=='[REDACTED]')throw Error('Packed text primitives'); if(schema.properties.schemaVersion.const!==1)throw Error('Schema export'); validateNotificationEvent(createCheckEvent({status:'success',data:{filesChecked:1,errors:0,warnings:0}})); const cleanup=validateNotificationEvent(createBuildCleanupEvent({status:'success',data:{mode:'dry-run',subscriptionCode:'synthetic',retentionDays:30,keepLatest:10,cleanupStatus:'dry-run',scannedCount:0,eligibleCount:0,plannedCount:0,deletionRequestedCount:0,skippedCount:0,failedCount:0,unknownCount:0,deferredCount:0,durationMs:0}})); if(cleanup.eventType!=='ccv2.build-cleanup.completed'||cleanup.data.mode!=='dry-run'||cleanup.data.deletionRequestedCount!==0)throw Error('Packed cleanup event');`,
     );
     types.push(
-      `import {createCheckEvent,stripAngleBracketText,redactJwtLikeTokens,type NotificationEvent} from '@commercekit-tools/notification-contract'; const event:NotificationEvent=createCheckEvent({status:'success',data:{filesChecked:1,errors:0,warnings:0}}); void event; const text:string=stripAngleBracketText(redactJwtLikeTokens('synthetic'));void text;`,
+      `import {createCheckEvent,createBuildCleanupEvent,stripAngleBracketText,redactJwtLikeTokens,type NotificationEvent,type BuildCleanupEvent} from '@commercekit-tools/notification-contract'; const event:NotificationEvent=createCheckEvent({status:'success',data:{filesChecked:1,errors:0,warnings:0}}); void event; const text:string=stripAngleBracketText(redactJwtLikeTokens('synthetic'));void text;const cleanup:BuildCleanupEvent=createBuildCleanupEvent({status:'success',data:{mode:'dry-run',subscriptionCode:'synthetic',retentionDays:30,keepLatest:10,cleanupStatus:'dry-run',scannedCount:0,eligibleCount:0,plannedCount:0,deletionRequestedCount:0,skippedCount:0,failedCount:0,unknownCount:0,deferredCount:0,durationMs:0}});void cleanup;`,
     );
   }
   if (!selected || selected === 'ccv2-client') {