[anilkreddy]

Summary

Replace Notify's duplicated NotificationEvent schema, types, JSON parsing, Ajv validation and context extraction/merge with public exports from @commercekit-tools/notification-contract@0.0.2. Pin the GitHub Packages dependency, configure read-only install authentication, remove direct Ajv dependencies and bundle all runtime dependencies into the Action.

Notify retains filesystem safety, templates, provider escaping and redaction, webhook restrictions, delivery/retry/timeout/redirect policies, outputs and failure handling. Workflow consumers need no package authentication. Latest main updates are integrated, including paired CodeQL actions, Node 24 type alignment and updated development tools.

Compatibility behavior

The migration adopts the package's stricter rules: empty trailing URL fragments are rejected, C1 control characters are omitted from runner metadata, and generated run URLs require an origin-only server URL. Tests cover these boundaries. A local diagnostic adapter supplies input-free validation errors; Notify's presentation sanitizer retains its established redaction labels and webhook/query URL filtering. See docs/shared-contract-migration.md for ownership and behavior details.

Validation

• Pinned Node 24.21.0 and pnpm 12.6.0; frozen-lockfile installation and full pnpm quality passed after resolving the lockfile conflict with main.
• 80 tests passed. Coverage: 97.46% statements, 88.92% branches, 97.5% functions, 99.18% lines.
• All 16 fixtures / 32 Slack and Teams golden payload snapshots unchanged.
• Bundle reproduction, standalone execution with mocked delivery, public-file scan and production dependency audit passed.
• Package installation uses job-level packages: read and install-step GITHUB_TOKEN. No new write permissions, long-lived PAT secrets or runtime package downloads.

Notify remains unreleased. No real provider calls, Build/Deploy changes, shared-package modifications, tags, releases or Marketplace publication.