@punica/editor 1.29.0 → 1.31.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@punica/editor",
-  "version": "1.29.0",
+  "version": "1.31.0",
   "description": "Punica Editor",
   "private": false,
   "type": "module",
@@ -29,6 +29,7 @@
     "check:duplicate-capabilities": "node scripts/check-duplicate-capabilities.mjs",
     "check:instruction-classes": "node scripts/check-instruction-classes.mjs",
     "report:capability-actions": "node scripts/report-capability-actions.mjs",
+    "report:input-enforcement": "node scripts/report-input-enforcement.mjs",
     "test": "vitest run",
     "test:watch": "vitest",
     "test:ui": "vitest --ui",

package/types/punica.module.kernel.policy.d.ts

@@ -263,9 +263,52 @@ declare module 'punica' {
            * permanent.
            */
           expiresAt?: number;
+          /**
+           * Which run this grant authorises, and where in it.
+           * Carried onto the `approval.granted` audit event, never
+           * onto the stored record — a `workspace` grant outlives the
+           * call that prompted it, so a trace on the record would name
+           * the wrong call the second time it is honoured.
+           */
+          traceId?: string;
+          parentSpanId?: string;
+          /** The sitting the run belongs to, one level above it. */
+          conversationId?: string;
         }
       ): ApprovalRecord;
 
+      /**
+       * Record that a person was asked and said no.
+       *
+       * **Writes nothing to the approval store.** A decline is not a
+       * grant with a negative sign — the gate only ever asks
+       * `hasApproval`, and a call nobody approved is already refused,
+       * so a stored negative record would be state with no reader.
+       * What this produces is the audit record the trail had no shape
+       * for: before it, `recordApproval` and `revokeApproval` were the
+       * only two expressible decisions, so "an operator looked at this
+       * and refused it" was indistinguishable from a client that
+       * simply moved on.
+       *
+       * The caller is responsible for having actually asked somebody.
+       * This records a decision; it cannot tell a human's refusal from
+       * one invented by whatever called it, which is why `decidedBy`
+       * is the load-bearing field — and why an absent one is honest
+       * where an invented one is not.
+       */
+      declineApproval(
+        req: PolicyRequest,
+        ctx?: {
+          workspaceId?: string;
+          decidedBy?: string;
+          /** Why, in the decider's words. Stored verbatim. */
+          reason?: string;
+          traceId?: string;
+          parentSpanId?: string;
+          conversationId?: string;
+        }
+      ): void;
+
       /**
        * `argsBinding` must be supplied when revoking a bound grant —
        * omitting it targets the unbound key and silently revokes