@zixcel/projection-contracts

日本語

Validate and seal bounded, renderer-neutral Data and Scene snapshots from explicitly selected owner-visible source revisions. Deterministic lineage and publication fences keep presentation tied to the accepted source without owning its meaning.

npm install @zixcel/projection-contracts

import { produce, scene, ProjectionSlot } from '@zixcel/projection-contracts'

const source = { owner: 'example', ref: 'selected', revision: 'revision-1', kind: 'example' }
const data = produce({
  key: 'review', producer: { id: 'builtin', version: '0.10.0',
    contract: 'projection/0.10.0', configuration: 'reviewed' },
  sources: [source], focus: 'resources', purpose: 'review',
  visibilityRef: 'owner-authorized', limits: {}
}, [{ source, items: [], relations: [], unresolved: [], truncated: false }])
const slot = new ProjectionSlot('review')
const receipt = slot.publish(slot.begin(), data)
const view = scene(data, { key: 'scene', focus: 'resources', purpose: 'review',
  regions: [], actions: [] })
console.log(receipt.revision, view.revision)

@zixcel/projection-contracts/client exposes browser-safe validation helpers. Node/browser hashing uses identical SHA-256 bytes; the dependency on @zixcel/interaction/input validates explicit interaction declarations.

The producer owns authorization, visible data and exact source selection. Scene labels and regions do not grant permissions. ProjectionSlot is an in-memory, disposable fence: it does not promise durability across restart. Use @zixcel/projection-runtime for bounded execution and durable publication.

Development

Run the repository workspace install, type checks and behavioral tests described in the root README. Public dependencies resolve from npm; no vendor archive or private registry is required. License · Notices.

Release provenance

Current releases use GitHub Actions OIDC trusted publishing from zixcel/data-presentation (publish-npm.yml), without a stored npm publishing token. The workflow verifies reviewed archive hashes and requires npm provenance metadata. Check the published version on npm and verify registry signatures and provenance with npm audit signatures in an installed consumer project. Package runtime behavior and API contracts are unchanged by this release.