@punica/editor 1.35.0 → 1.37.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@punica/editor",
-  "version": "1.35.0",
+  "version": "1.37.0",
   "description": "Punica Editor",
   "private": false,
   "type": "module",
@@ -44,7 +44,8 @@
     "test:host:ui": "vitest --ui --config vitest.host.config.ts",
     "format": "prettier --write \"./**/*.{ts,js,json,md}\"",
     "prepare": "husky install",
-    "report:progress-envelopes": "node scripts/report-progress-envelopes.mjs"
+    "report:progress-envelopes": "node scripts/report-progress-envelopes.mjs",
+    "report:ui-reveal-drift": "node scripts/report-ui-reveal-drift.mjs"
   },
   "eslintIgnore": [
     "node_modules",

package/types/index.d.ts

@@ -254,6 +254,43 @@ export function emitShellEvent(opts: ShellEventOptions): boolean;
  */
 export const WORKSPACE_STATE_GITIGNORE: string;
 
+/**
+ * The agent-mode policy profile: what the gate does with a call whose actor
+ * is `ai`, before any `.punica/policy.yaml` rule is consulted. The default
+ * holds every `write` and every `high`-risk call for a person and auto-runs
+ * the rest; a host may install its own with `setAgentPolicyProfile`. Exported
+ * so a host that explains a verdict without dispatching reads the same
+ * function the gate reads.
+ */
+export type AgentPolicyDecision = 'auto' | 'approval';
+export type AgentPolicyRisk = 'low' | 'medium' | 'high';
+export type AgentPolicySideEffect = 'none' | 'read' | 'write' | 'network';
+export interface AgentPolicyProfileInput {
+  capabilityId: string;
+  risk: AgentPolicyRisk;
+  sideEffect: AgentPolicySideEffect;
+}
+export type AgentPolicyProfile = (input: AgentPolicyProfileInput) => AgentPolicyDecision;
+export const defaultAgentPolicyProfile: AgentPolicyProfile;
+export function getAgentPolicyProfile(): AgentPolicyProfile;
+export function setAgentPolicyProfile(profile: AgentPolicyProfile | undefined): void;
+
+/**
+ * The gate's classifier from a declaration's `sideEffects` array to the one
+ * side effect the agent-mode profile reads: `write` beats `network` beats
+ * `read` beats `none`.
+ */
+export function sideEffectArrayToEnum(values: string[] | undefined): AgentPolicySideEffect;
+
+/**
+ * Whether critical events are written to the workspace's `.punica/events`.
+ * On by default. A host turns it off before `initialize()` for a boot that
+ * only reads, so the boot leaves no file behind; publishing, subscriptions
+ * and the in-memory audit ring are unaffected.
+ */
+export function setEventPersistence(enabled: boolean): void;
+export function isEventPersistenceEnabled(): boolean;
+
 /** The core-owned ApplicationProfile mechanism (`punica.shell.Profile`). */
 export const Profile: {
   readonly manager: import('punica').shell.Profile.IProfileManager;

package/types/punica.module.capability.d.ts

@@ -213,7 +213,8 @@ declare module 'punica' {
     | 'memory.write'
     | 'vcs.read'
     | 'vcs.write'
-    | 'flow.run';
+    | 'flow.run'
+    | 'ui.reveal';
 
   /**
    * Unified Capability Definition - Base interface for all capability types.
@@ -358,6 +359,26 @@ declare module 'punica' {
      */
     tags?: string[];
 
+    /**
+     * Where this capability is LISTED. `hub-only` says a family hub id is the
+     * agent's front door for this action, and this engine-tier id is not put
+     * in the default agent catalog or offered by `capability.search`.
+     *
+     * It changes listing, never reach: the id stays fully callable through the
+     * gateway, stays in `capability.catalog`, and `capability.describe` still
+     * answers for it when a caller names it.
+     *
+     * Declare it only where a hub id performs the SAME action — four
+     * `object-storage.<engine>.deleteObject` ids whose description is the
+     * hub's, word for word. An engine id that does something of its own
+     * (`mlops.dvc.repro`) is not hub-only, and a declaration that marks
+     * everything is no more informative than one that marks nothing.
+     *
+     * Omitted means `default`. Extension-origin only: `CapabilitySpec` drops
+     * consumer-facing metadata, so a core capability cannot carry it.
+     */
+    agentVisibility?: 'default' | 'hub-only';
+
     /**
      * Execution defaults for this capability.
      * These defaults are applied unless overridden at workflow node or run level.