diff --git a/README.md b/README.md index d8a6141..d1336e6 100644 --- a/README.md +++ b/README.md @@ -2,7 +2,7 @@ Shared contracts and runtime libraries for CommerceKit GitHub Actions. This public repository is a pnpm monorepo, not a GitHub Marketplace Action. There is no root `action.yml`. -The first integration release is `0.0.1` for both packages, distributed under the `preview` dist-tag. APIs remain pre-1.0; verify registry publication before installation. Placeholder reserved versions, if published later, are not supported dependencies. +The current integration release is `0.0.2` for both packages, distributed under the `preview` dist-tag. APIs remain pre-1.0; verify registry publication before installation. Placeholder reserved versions, if published later, are not supported dependencies. | Package | Responsibility | Consumers | | ------------------------------------------ | --------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------ | diff --git a/RELEASING.md b/RELEASING.md index 65fa65d..06a1648 100644 --- a/RELEASING.md +++ b/RELEASING.md @@ -6,7 +6,7 @@ Nothing is published by a feature PR or ordinary CI. Package versions are immuta 2. Verify main CI and CodeQL. 3. Optionally dispatch `reserve-package-names` with confirmation `RESERVE-COMMERCEKIT-PACKAGES`. It publishes only temporary unsupported `0.0.0-reserved.1` packages under `reserved`, never source implementations or `preview`/`latest`. Both versions are checked absent before publishing. If one succeeds and the second fails, stop for owner review rather than bypassing immutability checks. 4. Configure public visibility, repository association and Actions read access as documented in `docs/github-packages.md`. -5. Prepare a selected-package version/changelog PR. Source manifests currently express intended `0.0.1`, not publication evidence. +5. Prepare a selected-package version/changelog PR. Source manifests currently express intended `0.0.2`, not publication evidence. 6. Merge the reviewed version PR. 7. Dispatch `publish-package`: package `notification-contract` or `ccv2-client`, channel `preview` or `stable`, exact confirmation `PUBLISH-COMMERCEKIT-PREVIEW` or `PUBLISH-COMMERCEKIT-STABLE`. Preview accepts nonzero `0.x.y` initial releases (including `0.0.1`) or `0.x.y-preview.n`; stable requires 1.0.0 or later without prerelease. The workflow checks version absence and successful CI/CodeQL for the exact main commit, runs full quality and the selected pack/install checks, and verifies clean generated files. It retains the tested tarball in runner temporary storage, verifies its SHA-256 immediately before publication, and publishes those exact bytes with `preview` or `latest` and lifecycle scripts disabled. No source-directory repack or artifact upload is involved. 8. Verify the exact package version in GitHub Packages and its visibility/access. @@ -35,10 +35,10 @@ Wait for publication success and verify the exact registry version before the se ```sh gh workflow run create-package-release.yml --ref main \ - -f package=notification-contract -f version=0.0.1 \ + -f package=notification-contract -f version=0.0.2 \ -f confirmation=CREATE-COMMERCEKIT-PACKAGE-RELEASE ``` -This creates `notification-contract-v0.0.1`; selecting ccv2-client creates its independent `ccv2-client-v` tag. Stable publication uses channel `stable`, a reviewed stable manifest version and confirmation `PUBLISH-COMMERCEKIT-STABLE`. +This creates `notification-contract-v0.0.2`; selecting ccv2-client creates its independent `ccv2-client-v` tag. Stable publication uses channel `stable`, a reviewed stable manifest version and confirmation `PUBLISH-COMMERCEKIT-STABLE`. Tags are an output of the verified release phase, not a publication trigger. This keeps failed publication from creating a misleading release tag and avoids relying on a token-created tag to trigger another workflow. Both release phases require explicit dispatch. The publish and Release jobs have `checks: read` to verify commit check results and `security-events: read` to verify exact-commit main CodeQL analyses and the absence of open alerts; CI remains read-only and publication has no contents-write permission. diff --git a/THIRD_PARTY_NOTICES.md b/THIRD_PARTY_NOTICES.md index 1dbccb2..dffff54 100644 --- a/THIRD_PARTY_NOTICES.md +++ b/THIRD_PARTY_NOTICES.md @@ -38,7 +38,7 @@ Generated from the actual installed lockfile dependencies. Packages are not bund | @types/esrecurse | 4.3.1 | MIT | | @types/estree | 1.0.10 | MIT | | @types/json-schema | 7.0.15 | MIT | -| @types/node | 24.19.2 | MIT | +| @types/node | 26.6.6 | MIT | | @typescript-eslint/eslint-plugin | 8.72.1 | MIT | | @typescript-eslint/parser | 8.72.1 | MIT | | @typescript-eslint/project-service | 8.72.1 | MIT | @@ -93,7 +93,7 @@ Generated from the actual installed lockfile dependencies. Packages are not bund | flatted | 3.4.4 | ISC | | fsevents | 2.3.3 | MIT | | glob-parent | 6.0.2 | ISC | -| globals | 17.13.0 | MIT | +| globals | 17.14.0 | MIT | | hashery | 1.5.1 | MIT | | hookified | 1.15.1 | MIT | | hookified | 2.2.0 | MIT | @@ -146,7 +146,7 @@ Generated from the actual installed lockfile dependencies. Packages are not bund | type-check | 0.4.0 | MIT | | typescript | 6.0.3 | Apache-2.0 | | typescript-eslint | 8.72.1 | MIT | -| undici-types | 7.24.6 | MIT | +| undici-types | 8.9.0 | MIT | | uri-js | 4.4.1 | BSD-2-Clause | | vite | 8.3.6 | MIT | | vitest | 5.1.0 | MIT | diff --git a/compatibility/tests/release-safety.test.mjs b/compatibility/tests/release-safety.test.mjs index 6253efa..3d33940 100644 --- a/compatibility/tests/release-safety.test.mjs +++ b/compatibility/tests/release-safety.test.mjs @@ -7,7 +7,7 @@ import { join } from 'node:path'; it('publication requires exact package/channel/confirmation and pre-1.0 version', () => { for (const name of ['notification-contract', 'ccv2-client']) expect(releasePlan(name, 'preview', 'PUBLISH-COMMERCEKIT-PREVIEW')).toMatchObject({ - version: '0.0.1', + version: '0.0.2', tag: 'preview', }); for (const args of [ diff --git a/docs/github-packages.md b/docs/github-packages.md index 536182f..cc57ab8 100644 --- a/docs/github-packages.md +++ b/docs/github-packages.md @@ -29,8 +29,8 @@ Pin exact versions only after they are published and accessible: ```json { "dependencies": { - "@commercekit-tools/notification-contract": "0.0.1", - "@commercekit-tools/ccv2-client": "0.0.1" + "@commercekit-tools/notification-contract": "0.0.2", + "@commercekit-tools/ccv2-client": "0.0.2" } } ``` diff --git a/packages/ccv2-client/CHANGELOG.md b/packages/ccv2-client/CHANGELOG.md index b80ec25..c6feb02 100644 --- a/packages/ccv2-client/CHANGELOG.md +++ b/packages/ccv2-client/CHANGELOG.md @@ -1,5 +1,11 @@ # ccv2-client changelog +## 0.0.2 + +Maintenance release following Dependabot updates to globals 17.14.0 and @types/node 26.6.6 (including undici-types 8.9.0). Refresh dependency notices and release metadata. Runtime JavaScript, declarations and the NotificationEvent v1 schema are unchanged; validation continues on Node 24.21.0. Includes the verified package Release pagination fix in repository tooling. + +Distributed under the `preview` dist-tag for exact-version consumer integration; pre-1.0 API status is unchanged. + ## 0.0.1 Initial technical-user OAuth, memory-only token management, explicit safe-read/unsafe-mutation policies and bounded JSON/empty/binary HTTP transport. diff --git a/packages/ccv2-client/README.md b/packages/ccv2-client/README.md index 0a7aa6e..de0e3fd 100644 --- a/packages/ccv2-client/README.md +++ b/packages/ccv2-client/README.md @@ -36,6 +36,6 @@ Inject fetch, clock, abortable sleep, random and secret masking through `runtime Install from GitHub Packages after a supported version is published. Configure `@commercekit-tools:registry=https://npm.pkg.github.com`; local users need a classic PAT with `read:packages` in user-level configuration. Consumer Actions need package Actions read access and `GITHUB_TOKEN` with `packages: read`. See the repository authentication guide. Pin exact versions, never ranges. -Current release: source version `0.0.1`, an initial pre-1.0 integration release under the `preview` dist-tag. Verify registry availability before installation and pin `0.0.1` exactly. Stable API and coordinated consumer/Sandbox validation remain future gates. Reservation versions are unsupported. +Current release: source version `0.0.2`, an initial pre-1.0 integration release under the `preview` dist-tag. Verify registry availability before installation and pin `0.0.2` exactly. Stable API and coordinated consumer/Sandbox validation remain future gates. Reservation versions are unsupported. Independent package SemVer applies; stable breaking changes require a major increment. NotificationEvent schema version is separate from package version. Preserve current consumer contracts during migration. No telemetry or logging is performed. Use synthetic tests and register exact runtime secrets; pattern redaction cannot identify all secrets. diff --git a/packages/ccv2-client/package.json b/packages/ccv2-client/package.json index d6e3580..da3e62b 100644 --- a/packages/ccv2-client/package.json +++ b/packages/ccv2-client/package.json @@ -1,6 +1,6 @@ { "name": "@commercekit-tools/ccv2-client", - "version": "0.0.1", + "version": "0.0.2", "description": "Framework-independent CCv2 technical-user authentication and safe HTTP transport.", "license": "MIT", "type": "module", diff --git a/packages/notification-contract/CHANGELOG.md b/packages/notification-contract/CHANGELOG.md index 322a42c..e1a4f1e 100644 --- a/packages/notification-contract/CHANGELOG.md +++ b/packages/notification-contract/CHANGELOG.md @@ -1,5 +1,11 @@ # notification-contract changelog +## 0.0.2 + +Maintenance release following Dependabot updates to globals 17.14.0 and @types/node 26.6.6 (including undici-types 8.9.0). Refresh dependency notices and release metadata. Runtime JavaScript, declarations and the NotificationEvent v1 schema are unchanged; validation continues on Node 24.21.0. Includes the verified package Release pagination fix in repository tooling. + +Distributed under the `preview` dist-tag for exact-version consumer integration; pre-1.0 API status is unchanged. + ## 0.0.1 Initial NotificationEvent v1 schema, exact types, semantic validation, safe context merge, event factories and sanitization primitives. diff --git a/packages/notification-contract/README.md b/packages/notification-contract/README.md index 9f87654..947ec99 100644 --- a/packages/notification-contract/README.md +++ b/packages/notification-contract/README.md @@ -22,6 +22,6 @@ Extraction reads only approved runner fields, never event payloads. Explicit pro Install from GitHub Packages after a supported version is published. Configure `@commercekit-tools:registry=https://npm.pkg.github.com`; local users need a classic PAT with `read:packages` in user-level configuration. Consumer Actions need package Actions read access and `GITHUB_TOKEN` with `packages: read`. See the repository authentication guide. Pin exact versions, never ranges. -Current release: source version `0.0.1`, an initial pre-1.0 integration release under the `preview` dist-tag. Verify registry availability before installation and pin `0.0.1` exactly. Stable API and coordinated consumer/Sandbox validation remain future gates. Reservation versions are unsupported. +Current release: source version `0.0.2`, an initial pre-1.0 integration release under the `preview` dist-tag. Verify registry availability before installation and pin `0.0.2` exactly. Stable API and coordinated consumer/Sandbox validation remain future gates. Reservation versions are unsupported. Independent package SemVer applies; stable breaking changes require a major increment. NotificationEvent schema version is separate from package version. Preserve current consumer contracts during migration. No telemetry or logging is performed. Use synthetic tests and register exact runtime secrets; pattern redaction cannot identify all secrets. diff --git a/packages/notification-contract/package.json b/packages/notification-contract/package.json index 0cfb40d..dc16fa8 100644 --- a/packages/notification-contract/package.json +++ b/packages/notification-contract/package.json @@ -1,6 +1,6 @@ { "name": "@commercekit-tools/notification-contract", - "version": "0.0.1", + "version": "0.0.2", "description": "Provider-neutral NotificationEvent v1 contracts and factories.", "license": "MIT", "type": "module",