@punica/editor 1.42.0 → 1.44.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@punica/editor",
-  "version": "1.42.0",
+  "version": "1.44.0",
   "description": "Punica Editor",
   "private": false,
   "type": "module",

package/types/punica.module.kernel.ai.d.ts

@@ -72,6 +72,32 @@ declare module 'punica' {
          * reviewer instead.
          */
         approvers?: readonly string[];
+        /**
+         * The organisation those approvers hold their roles in
+         * (`kernel.PolicyRequest.org`), so a host that asks a reviewer
+         * asks the right one. Absent means the file named none.
+         */
+        org?: string;
+        /**
+         * How many of them must sign (`kernel.PolicyRequest.signatures`),
+         * when more than one. A card then says how many have, and offers
+         * a signature rather than a grant.
+         */
+        signatures?: number;
+        /**
+         * Who has signed so far, under which name — the record's own
+         * list, copied onto the question by `approvePending` when a
+         * signature lands and the chain is still short. A person on it
+         * cannot sign again.
+         */
+        signed?: ReadonlyArray<{ by: string; role?: string; atMs: number }>;
+        /**
+         * The scope the first signature was recorded at. The next ones are
+         * recorded at the same scope, whatever the card offered: a grant
+         * is one record, and two signatures at two scopes would be two
+         * half-signed records.
+         */
+        signedScope?: ApprovalScope;
         /**
          * Set by `referPending`: the question was handed to a reviewer
          * outside this host, under this name. A run waiting on it holds

package/types/punica.module.kernel.policy.d.ts

@@ -79,6 +79,19 @@ declare module 'punica' {
        * absent means anyone at this host may decide.
        */
       approvers?: readonly string[];
+      /**
+       * The organisation those approvers hold their roles in, from the
+       * file's `org:`. A role then counts only there; absent means a
+       * role in any of the person's organisations counts.
+       */
+      org?: string;
+      /**
+       * How many of those approvers must sign before the grant stands
+       * (the deciding rule's `signatures:`). Absent or `1` is one
+       * decision; `2` means two different people, each one an entry
+       * names, and a record with fewer is consulted as no grant at all.
+       */
+      signatures?: number;
     }
 
     /**
@@ -124,6 +137,12 @@ declare module 'punica' {
       timestampMs: number;
       /** Optional reason — surfaced in audit. */
       reason?: string;
+      /**
+       * Under which of the rule's names this person signed (`owner`,
+       * `role:<name>`, `user:<email>`) — a `signatures` chain records it
+       * per signer, the way a single grant records `decidedRole`.
+       */
+      role?: string;
     }
 
     /** Chain-level outcome of `recordChainDecision`. */
@@ -148,6 +167,19 @@ declare module 'punica' {
       | {
           type: 'single';
           approver: ApproverSpec;
+        }
+      | {
+          /**
+           * A rule's `signatures: N` (1.44.0): `required` different
+           * people, each one of the rule's `approvers` entries, in any
+           * order; any deny ends it. The people are not known when the
+           * chain opens — a role names a set — so `approverId` is the
+           * signer's address and the spec lists the rule's entries, not
+           * ids. The policy manager is this shape's caller.
+           */
+          type: 'signatures';
+          required: number;
+          approvers: readonly string[];
         };
 
     /** Snapshot of a running chain — read-only from the caller's POV. */
@@ -186,6 +218,17 @@ declare module 'punica' {
        * record + chain state by this id.
        */
       chainRef?: string;
+      /**
+       * The signatures a `signatures: N` rule collected on this record
+       * (1.44.0): how many it needs and who signed, under which name. A
+       * record with fewer signatures than `need` is stored — so the next
+       * signer finds it and a reader sees who is missing — and is never
+       * consulted as a grant. Absent on a single-decision grant.
+       */
+      signatures?: {
+        need: number;
+        by: ReadonlyArray<{ by: string; role?: string; atMs: number }>;
+      };
       /**
        * The arguments this grant covers. See `PolicyRequest.argsBinding`.
        * Persisted so a grant matches only the arguments it was given
@@ -224,6 +267,10 @@ declare module 'punica' {
       maxScope?: ApprovalScope;
       /** The deciding `require` rule's `approvers:`, when it wrote them. */
       approvers?: readonly string[];
+      /** The organisation those approvers hold their roles in (the file's `org:`). */
+      org?: string;
+      /** How many of them must sign (the rule's `signatures:`), when more than one. */
+      signatures?: number;
       reason?: string;
       /**
        * Set when a rule from a policy template decided this. Absent
@@ -541,6 +588,14 @@ declare module 'punica' {
        * which is what every rule written before this field meant.
        */
       approvers?: string[];
+      /**
+       * How many of those approvers must sign, only with `approvers:` on
+       * `effect: 'require'`. `2` is two different people, each one an
+       * entry names, in any order; one person cannot sign twice, and a
+       * signer needs a name. Absent or `1` is one decision, which is
+       * what every rule written before this field meant.
+       */
+      signatures?: number;
       /** Shown to the user on a denial and written into the audit record. */
       reason?: string;
     }
@@ -557,6 +612,10 @@ declare module 'punica' {
       scope?: ApprovalScope;
       /** The rule's `approvers`, when it wrote them (`effect: require` only). */
       approvers?: string[];
+      /** The file's `org:`, when it wrote one — where those approvers hold their roles. */
+      org?: string;
+      /** The rule's `signatures`, when more than one. */
+      signatures?: number;
       /** Digest of the template's rules — which policy text was in force. */
       digest?: string;
       /**
@@ -594,6 +653,12 @@ declare module 'punica' {
       name: string;
       description?: string;
       workspaceId?: string;
+      /**
+       * The file's `org:` — the organisation the rules' `approvers:`
+       * resolve against. Set by the loader on every template of a file
+       * that wrote it, and carried onto each rule's ref.
+       */
+      org?: string;
       rules: PolicyRule[];
       /**
        * Where the template came from. `file` templates are owned by