@zixcel/projection-contracts 0.10.0 → 0.10.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/README.ja.md ADDED
@@ -0,0 +1,9 @@
1
+ # Projection snapshotの検証
2
+
3
+ [English](README.md)
4
+
5
+ 選択済みowner-visible source revisionからboundedなData/Sceneを構築・検証します。lineage/publication fenceを保持し、製品の意味・権限は持ちません。
6
+
7
+ browser-safe検証は@zixcel/projection-contracts/clientです。Node入口のproduce/sceneとin-memory ProjectionSlotはsnapshot構築/公開を扱い、再起動を越えるdurabilityはroot runtime/storeが担当します。
8
+
9
+ 依存は正式npm版です。rootの[playground](../../playground/data-to-screen/README.ja.md)と[運用](../../docs/architecture-and-operations.ja.md)で公開APIの利用と独立consumerを確認します。型・schema・検証の保証と、製品authorityは区別します。LICENSE/NOTICEを保持します。
package/README.md CHANGED
@@ -1,11 +1,13 @@
1
1
  # @zixcel/projection-contracts
2
2
 
3
+ [日本語](README.ja.md)
4
+
3
5
  Validate and seal bounded, renderer-neutral Data and Scene snapshots from explicitly
4
6
  selected owner-visible source revisions. Deterministic lineage and publication
5
7
  fences keep presentation tied to the accepted source without owning its meaning.
6
8
 
7
9
  ```sh
8
- npm install @zixcel/projection-contracts@0.10.0
10
+ npm install @zixcel/projection-contracts@0.10.2
9
11
  ```
10
12
 
11
13
  ```ts
@@ -39,3 +41,7 @@ disposable fence: it does not promise durability across restart. Use
39
41
  Run the repository workspace install, type checks and behavioral tests described
40
42
  in the root README. Public dependencies resolve from npm; no vendor archive or
41
43
  private registry is required. [License](LICENSE) · [Notices](NOTICE).
44
+
45
+ ## Release provenance
46
+
47
+ Starting with 0.10.1, releases use GitHub Actions OIDC trusted publishing from `zixcel/projection-runtime` (`publish-npm.yml`), without a stored npm publishing token. The workflow verifies reviewed archive hashes and requires npm provenance metadata. Check the published version on npm and verify registry signatures and provenance with `npm audit signatures` in an installed consumer project. Package runtime behavior and API contracts are unchanged by this release.
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@zixcel/projection-contracts",
3
- "version": "0.10.0",
3
+ "version": "0.10.2",
4
4
  "description": "Renderer-independent bounded projection, lineage and Scene contracts",
5
5
  "type": "module",
6
6
  "license": "Apache-2.0",
@@ -13,7 +13,8 @@
13
13
  "README.md",
14
14
  "LICENSE",
15
15
  "NOTICE",
16
- "LICENSE-PREVIOUS"
16
+ "LICENSE-PREVIOUS",
17
+ "README.ja.md"
17
18
  ],
18
19
  "exports": {
19
20
  ".": {