@zixcel/projection-runtime 0.10.1 → 0.10.2

package/README.ja.md

@@ -0,0 +1,27 @@
+# Projectionのbounded実行と表示
+
+[English](README.md)
+
+登録したproducerをbounded Node workerで実行し、正確なowner sourceから読み取り専用snapshotを公開します。private storeとpublication fenceを持ち、製品の意味・権限・可視性・retentionは利用アプリが決めます。
+
+| package | 責務 |
+| --- | --- |
+| projection-contracts | Data/Scene検証、正確なidentity、publication fence |
+| projection-runtime | worker、private store、durable公開 |
+| projection-client | snapshot採用、表示状態、古いaction拒否 |
+| dom-renderer | bounded DOM描画と宣言済みinteraction |
+
+現在の物理名を維持し、候補名への実移行は別の確認段階にします。[playground](playground/data-to-screen/README.ja.md)でproducerから表示、更新、拒否まで試せます。[責務と運用](docs/architecture-and-operations.ja.md)を参照してください。
+
+```sh
+pnpm install --frozen-lockfile --ignore-scripts
+pnpm -r --include-workspace-root typecheck
+pnpm -r --include-workspace-root test
+pnpm test:consumer
+pnpm playground:build
+pnpm playground:serve
+```
+
+runtime storeにはLinux/WSL、既存flock/setpriv、private parent directoryが必要です。任意commandを実行するOS sandboxではありません。依存は正式registry版を宣言し、開発workspace linkとTGZの独立consumerを分けます。
+
+公開はownerのpublish-npm.ymlで、review済みhash・consumer検証・OIDC provenanceを確認します。公開と実アプリ配備は別で、private管理repoや他組織secretを通常運用に要求しません。LICENSE/NOTICEを保持します。

package/README.md

@@ -1,14 +1,27 @@
 # @zixcel/projection-runtime
 
+[日本語](README.ja.md)
+
 Execute explicitly registered projection producers in bounded Node.js workers and
 publish disposable read-only snapshots with durable fencing and exact owner leases.
 The runtime never chooses a latest source, loads request-supplied code or owns
 application authorization. Owner adapters decide visibility and retention.
 
+## Package responsibilities
+
+| Package | Owns | Does not own |
+| --- | --- | --- |
+| projection-contracts | Validated Data/Scene snapshots, exact identities and publication fences | Product authorization, durable storage or arbitrary producer code |
+| projection-runtime | Registered bounded workers and private durable snapshot publication | Product meaning or source visibility decisions |
+| projection-client | Exact snapshot adoption and presentation state | Canonical product state or permission grants |
+| dom-renderer | Bounded DOM rendering and declared interactions | Remote scripts, product commands or account credentials |
+
+The current physical names remain unchanged while their migration candidates are reviewed. [Data to screen playground](playground/data-to-screen/README.md) uses public exports and shows the stages in one runnable example. [Architecture and operations](docs/architecture-and-operations.md) explains source, distribution and rollback ownership.
+
 ## Install and use
 
 ```sh
-npm install @zixcel/projection-runtime@0.10.0
+npm install @zixcel/projection-runtime@0.10.2
 ```
 
 ```ts
@@ -69,7 +82,7 @@ local development convenience. See [LICENSE](LICENSE) and [NOTICE](NOTICE).
 
 ## Package ownership and scope migration
 
-[保守正本と移行条件](docs/package-ownership.ja.md)。The maintained source and npm scope are owned by Zixcel. New `@zixcel` names require their first registry publication before downstream dependency migration. Existing `@hathq` releases remain historical distributions.
+[保守正本と移行条件](docs/package-ownership.ja.md)。The maintained source and npm scope are owned by Zixcel. Current `@zixcel` dependencies resolve through the official npm registry. Historical `@hathq` releases remain provenance history; new versions are adopted only after their official artifacts are verified.
 
 ## Release provenance
 

package/docs/architecture-and-operations.ja.md

@@ -0,0 +1,21 @@
+# Projection packageの責務と運用
+
+[English](architecture-and-operations.md)
+
+選択済みsource dataをboundedで正確な表示snapshotへ変換するworkspaceです。rootはworker/store実行、contractsは検証/封印、clientは表示採用、rendererは導入済みDOM部品を持ちます。viewは製品権限を所有・変更しません。
+
+開発は宣言済みpnpm workspace、配布consumerは同じ公開exportsとregistry版を使います。worker/Storageは既存Linux/WSL条件、browserはbrowser-safe入口を使い、private storeやworkerを直接実行しません。
+
+## owner検証と公開
+
+frozen install、workspace型/test、playground build/browser test、test:consumerを実行します。consumerは4TGZをcheckout外に空npm設定で導入し、worker/storeとclient拒否を確認します。private管理repoに依存しません。
+
+既存publish-npm.ymlのTrusted Publisher bindingを維持し、review済みhash、source test、pack consumerを確認してOIDC公開します。複数公開はatomicではなく、既存integrityを照合して未公開分だけ再開します。公式hash/attestationとsource test成功は別の証跡です。改名/移管ではsource/trust mappingを先に対応させます。
+
+## playgroundと利用アプリ運用
+
+playground:buildは実worker/storeで2つの擬似snapshotを作り、公開client/rendererをbundleします。serveは生成assetだけをloopbackへ配信し、CrowsiのHost/Origin/Fetch-Site判定を再利用します。実account/credential/provider、任意code、製品DBには接続しません。実変更が必要なアプリは操作/authority束縛を明示して設定します。
+
+利用アプリのownerがpackage/sourceを固定し、自分のprovider workflowでbuild/preview/検証/昇格します。npm公開を配備とは扱わず、artifact/lockを独立rollbackできます。snapshotは派生状態で、保持した正確なowner sourceから再構築し、暗黙の最新版へ追従しません。
+
+通常更新にCoelaRelease、他組織private source、中央secret、無関係releaseを要求しません。可視性/retention/producerの製品上の意味はアプリが持ち、source/OS/authorityの未確認は明示します。

package/docs/architecture-and-operations.md

@@ -0,0 +1,21 @@
+# Projection package architecture and operations
+
+[日本語](architecture-and-operations.ja.md)
+
+Use this feature workspace when explicitly selected source data must become a bounded, exact display snapshot. The root owns worker/store execution, contracts owns snapshot validation/sealing, client owns presentation adoption and renderer owns installed DOM primitives. A view does not own or change product authority.
+
+Development uses the declared pnpm workspace. Public imports, package entrypoints and versioned registry dependencies are the same interfaces used by the independent archive consumer. Keep storage and worker processes on the documented Linux/WSL platform; browser consumers use their browser-safe package entrypoints. A browser does not execute the worker or access the private store.
+
+## Owner validation and release
+
+Run frozen install, workspace type checks/tests, playground build/browser tests and test:consumer. The latter packs all four candidates, installs them outside the workspace with empty npm configuration and executes the worker/store example plus client rejection cases. Public registry dependencies resolve independently of private coordination.
+
+The existing publish-npm.yml workflow keeps its Trusted Publisher binding. It verifies reviewed archive hashes, source tests and the packed consumer before OIDC publication. Multiple package publication is not atomic; verify already published integrities and resume only missing versions. Official archive hashes and registry attestations are independent of source test success. Package renames/repository transfers require their new source/trust mappings before publication.
+
+## Playground and application operations
+
+playground:build generates two synthetic snapshots with the real bounded worker/store implementation and bundles the public client/renderer. playground:serve serves only generated assets on loopback and reuses Crowsi Host/Origin/Fetch-Site policy. No account, credential, provider, arbitrary code or persistent product DB is contacted. An application that needs real mutations supplies its own reviewed operation/authority binding.
+
+Deploying an application's UI is owned by that application. Pin reviewed package versions and source references, then build/preview/verify/promote through its own provider workflow. Do not treat this package's npm publication as deployment. Roll back the application artifact/package lock independently. Cached snapshots are derived state; rebuild only from exact retained owner source, not an implicit latest revision.
+
+No ordinary update requires CoelaRelease, another organization's private checkout, central secret or unrelated release. Product-specific visibility, retention and producer meaning remain with the application. Report unknown or unsupported source/OS/authority states explicitly.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zixcel/projection-runtime",
-  "version": "0.10.1",
+  "version": "0.10.2",
   "type": "module",
   "license": "Apache-2.0",
   "description": "Bounded read-only producer execution and disposable durable projection publication",
@@ -12,7 +12,10 @@
     "README.md",
     "LICENSE",
     "NOTICE",
-    "LICENSE-PREVIOUS"
+    "LICENSE-PREVIOUS",
+    "README.ja.md",
+    "docs/architecture-and-operations.md",
+    "docs/architecture-and-operations.ja.md"
   ],
   "exports": {
     ".": {
@@ -25,11 +28,15 @@
     }
   },
   "dependencies": {
-    "@zixcel/projection-contracts": "0.10.1"
+    "@zixcel/projection-contracts": "0.10.2"
   },
   "scripts": {
     "test": "node --test test/*.test.mjs",
-    "typecheck": "tsc --noEmit --strict --module NodeNext --moduleResolution NodeNext --target ES2022 test/public-types.mts"
+    "typecheck": "tsc --noEmit --strict --module NodeNext --moduleResolution NodeNext --target ES2022 test/public-types.mts",
+    "playground:build": "node scripts/build-playground.mjs",
+    "playground:serve": "node scripts/serve-playground.mjs",
+    "playground:test": "node test/playground-browser.mjs",
+    "test:consumer": "node scripts/verify-packed-consumer.mjs"
   },
   "repository": {
     "type": "git",
@@ -42,7 +49,12 @@
   "types": "./src/runtime.d.mts",
   "devDependencies": {
     "typescript": "5.9.3",
-    "@types/node": "24.12.0"
+    "@types/node": "24.12.0",
+    "esbuild": "0.28.1",
+    "@playwright/test": "1.62.1",
+    "@zixcel/projection-client": "0.10.2",
+    "@zixcel/dom-renderer": "0.10.2",
+    "@crowsi/browser-security": "0.10.0"
   },
   "packageManager": "pnpm@10.29.3"
 }