chore: release shared packages at 0.0.2

README.md

@@ -2,7 +2,7 @@
 
 Shared contracts and runtime libraries for CommerceKit GitHub Actions. This public repository is a pnpm monorepo, not a GitHub Marketplace Action. There is no root `action.yml`.
 
-The first integration release is `0.0.1` for both packages, distributed under the `preview` dist-tag. APIs remain pre-1.0; verify registry publication before installation. Placeholder reserved versions, if published later, are not supported dependencies.
+The current integration release is `0.0.2` for both packages, distributed under the `preview` dist-tag. APIs remain pre-1.0; verify registry publication before installation. Placeholder reserved versions, if published later, are not supported dependencies.
 
 | Package                                    | Responsibility                                                                                | Consumers                                                                      |
 | ------------------------------------------ | --------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------ |

RELEASING.md

@@ -6,7 +6,7 @@ Nothing is published by a feature PR or ordinary CI. Package versions are immuta
 2. Verify main CI and CodeQL.
 3. Optionally dispatch `reserve-package-names` with confirmation `RESERVE-COMMERCEKIT-PACKAGES`. It publishes only temporary unsupported `0.0.0-reserved.1` packages under `reserved`, never source implementations or `preview`/`latest`. Both versions are checked absent before publishing. If one succeeds and the second fails, stop for owner review rather than bypassing immutability checks.
 4. Configure public visibility, repository association and Actions read access as documented in `docs/github-packages.md`.
-5. Prepare a selected-package version/changelog PR. Source manifests currently express intended `0.0.1`, not publication evidence.
+5. Prepare a selected-package version/changelog PR. Source manifests currently express intended `0.0.2`, not publication evidence.
 6. Merge the reviewed version PR.
 7. Dispatch `publish-package`: package `notification-contract` or `ccv2-client`, channel `preview` or `stable`, exact confirmation `PUBLISH-COMMERCEKIT-PREVIEW` or `PUBLISH-COMMERCEKIT-STABLE`. Preview accepts nonzero `0.x.y` initial releases (including `0.0.1`) or `0.x.y-preview.n`; stable requires 1.0.0 or later without prerelease. The workflow checks version absence and successful CI/CodeQL for the exact main commit, runs full quality and the selected pack/install checks, and verifies clean generated files. It retains the tested tarball in runner temporary storage, verifies its SHA-256 immediately before publication, and publishes those exact bytes with `preview` or `latest` and lifecycle scripts disabled. No source-directory repack or artifact upload is involved.
 8. Verify the exact package version in GitHub Packages and its visibility/access.
@@ -35,10 +35,10 @@ Wait for publication success and verify the exact registry version before the se
 
 ```sh
 gh workflow run create-package-release.yml --ref main \
-  -f package=notification-contract -f version=0.0.1 \
+  -f package=notification-contract -f version=0.0.2 \
   -f confirmation=CREATE-COMMERCEKIT-PACKAGE-RELEASE
 ```
 
-This creates `notification-contract-v0.0.1`; selecting ccv2-client creates its independent `ccv2-client-v<version>` tag. Stable publication uses channel `stable`, a reviewed stable manifest version and confirmation `PUBLISH-COMMERCEKIT-STABLE`.
+This creates `notification-contract-v0.0.2`; selecting ccv2-client creates its independent `ccv2-client-v<version>` tag. Stable publication uses channel `stable`, a reviewed stable manifest version and confirmation `PUBLISH-COMMERCEKIT-STABLE`.
 
 Tags are an output of the verified release phase, not a publication trigger. This keeps failed publication from creating a misleading release tag and avoids relying on a token-created tag to trigger another workflow. Both release phases require explicit dispatch. The publish and Release jobs have `checks: read` to verify commit check results and `security-events: read` to verify exact-commit main CodeQL analyses and the absence of open alerts; CI remains read-only and publication has no contents-write permission.

THIRD_PARTY_NOTICES.md

@@ -38,7 +38,7 @@ Generated from the actual installed lockfile dependencies. Packages are not bund
 | @types/esrecurse                      | 4.3.1   | MIT              |
 | @types/estree                         | 1.0.10  | MIT              |
 | @types/json-schema                    | 7.0.15  | MIT              |
-| @types/node                           | 24.19.2 | MIT              |
+| @types/node                           | 26.6.6  | MIT              |
 | @typescript-eslint/eslint-plugin      | 8.72.1  | MIT              |
 | @typescript-eslint/parser             | 8.72.1  | MIT              |
 | @typescript-eslint/project-service    | 8.72.1  | MIT              |
@@ -93,7 +93,7 @@ Generated from the actual installed lockfile dependencies. Packages are not bund
 | flatted                               | 3.4.4   | ISC              |
 | fsevents                              | 2.3.3   | MIT              |
 | glob-parent                           | 6.0.2   | ISC              |
-| globals                               | 17.13.0 | MIT              |
+| globals                               | 17.14.0 | MIT              |
 | hashery                               | 1.5.1   | MIT              |
 | hookified                             | 1.15.1  | MIT              |
 | hookified                             | 2.2.0   | MIT              |
@@ -146,7 +146,7 @@ Generated from the actual installed lockfile dependencies. Packages are not bund
 | type-check                            | 0.4.0   | MIT              |
 | typescript                            | 6.0.3   | Apache-2.0       |
 | typescript-eslint                     | 8.72.1  | MIT              |
-| undici-types                          | 7.24.6  | MIT              |
+| undici-types                          | 8.9.0   | MIT              |
 | uri-js                                | 4.4.1   | BSD-2-Clause     |
 | vite                                  | 8.3.6   | MIT              |
 | vitest                                | 5.1.0   | MIT              |

compatibility/tests/release-safety.test.mjs

@@ -7,7 +7,7 @@ import { join } from 'node:path';
 it('publication requires exact package/channel/confirmation and pre-1.0 version', () => {
   for (const name of ['notification-contract', 'ccv2-client'])
     expect(releasePlan(name, 'preview', 'PUBLISH-COMMERCEKIT-PREVIEW')).toMatchObject({
-      version: '0.0.1',
+      version: '0.0.2',
       tag: 'preview',
     });
   for (const args of [

docs/github-packages.md

@@ -29,8 +29,8 @@ Pin exact versions only after they are published and accessible:
 ```json
 {
   "dependencies": {
-    "@commercekit-tools/notification-contract": "0.0.1",
-    "@commercekit-tools/ccv2-client": "0.0.1"
+    "@commercekit-tools/notification-contract": "0.0.2",
+    "@commercekit-tools/ccv2-client": "0.0.2"
   }
 }
 ```

packages/ccv2-client/CHANGELOG.md

@@ -1,5 +1,11 @@
 # ccv2-client changelog
 
+## 0.0.2
+
+Maintenance release following Dependabot updates to globals 17.14.0 and @types/node 26.6.6 (including undici-types 8.9.0). Refresh dependency notices and release metadata. Runtime JavaScript, declarations and the NotificationEvent v1 schema are unchanged; validation continues on Node 24.21.0. Includes the verified package Release pagination fix in repository tooling.
+
+Distributed under the `preview` dist-tag for exact-version consumer integration; pre-1.0 API status is unchanged.
+
 ## 0.0.1
 
 Initial technical-user OAuth, memory-only token management, explicit safe-read/unsafe-mutation policies and bounded JSON/empty/binary HTTP transport.

packages/ccv2-client/README.md

@@ -36,6 +36,6 @@ Inject fetch, clock, abortable sleep, random and secret masking through `runtime
 
 Install from GitHub Packages after a supported version is published. Configure `@commercekit-tools:registry=https://npm.pkg.github.com`; local users need a classic PAT with `read:packages` in user-level configuration. Consumer Actions need package Actions read access and `GITHUB_TOKEN` with `packages: read`. See the repository authentication guide. Pin exact versions, never ranges.
 
-Current release: source version `0.0.1`, an initial pre-1.0 integration release under the `preview` dist-tag. Verify registry availability before installation and pin `0.0.1` exactly. Stable API and coordinated consumer/Sandbox validation remain future gates. Reservation versions are unsupported.
+Current release: source version `0.0.2`, an initial pre-1.0 integration release under the `preview` dist-tag. Verify registry availability before installation and pin `0.0.2` exactly. Stable API and coordinated consumer/Sandbox validation remain future gates. Reservation versions are unsupported.
 
 Independent package SemVer applies; stable breaking changes require a major increment. NotificationEvent schema version is separate from package version. Preserve current consumer contracts during migration. No telemetry or logging is performed. Use synthetic tests and register exact runtime secrets; pattern redaction cannot identify all secrets.

packages/ccv2-client/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@commercekit-tools/ccv2-client",
-  "version": "0.0.1",
+  "version": "0.0.2",
   "description": "Framework-independent CCv2 technical-user authentication and safe HTTP transport.",
   "license": "MIT",
   "type": "module",

packages/notification-contract/CHANGELOG.md

@@ -1,5 +1,11 @@
 # notification-contract changelog
 
+## 0.0.2
+
+Maintenance release following Dependabot updates to globals 17.14.0 and @types/node 26.6.6 (including undici-types 8.9.0). Refresh dependency notices and release metadata. Runtime JavaScript, declarations and the NotificationEvent v1 schema are unchanged; validation continues on Node 24.21.0. Includes the verified package Release pagination fix in repository tooling.
+
+Distributed under the `preview` dist-tag for exact-version consumer integration; pre-1.0 API status is unchanged.
+
 ## 0.0.1
 
 Initial NotificationEvent v1 schema, exact types, semantic validation, safe context merge, event factories and sanitization primitives.

packages/notification-contract/README.md

@@ -22,6 +22,6 @@ Extraction reads only approved runner fields, never event payloads. Explicit pro
 
 Install from GitHub Packages after a supported version is published. Configure `@commercekit-tools:registry=https://npm.pkg.github.com`; local users need a classic PAT with `read:packages` in user-level configuration. Consumer Actions need package Actions read access and `GITHUB_TOKEN` with `packages: read`. See the repository authentication guide. Pin exact versions, never ranges.
 
-Current release: source version `0.0.1`, an initial pre-1.0 integration release under the `preview` dist-tag. Verify registry availability before installation and pin `0.0.1` exactly. Stable API and coordinated consumer/Sandbox validation remain future gates. Reservation versions are unsupported.
+Current release: source version `0.0.2`, an initial pre-1.0 integration release under the `preview` dist-tag. Verify registry availability before installation and pin `0.0.2` exactly. Stable API and coordinated consumer/Sandbox validation remain future gates. Reservation versions are unsupported.
 
 Independent package SemVer applies; stable breaking changes require a major increment. NotificationEvent schema version is separate from package version. Preserve current consumer contracts during migration. No telemetry or logging is performed. Use synthetic tests and register exact runtime secrets; pattern redaction cannot identify all secrets.

packages/notification-contract/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@commercekit-tools/notification-contract",
-  "version": "0.0.1",
+  "version": "0.0.2",
   "description": "Provider-neutral NotificationEvent v1 contracts and factories.",
   "license": "MIT",
   "type": "module",