@punica/editor 1.44.0 → 1.45.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@punica/editor",
-  "version": "1.44.0",
+  "version": "1.45.1",
   "description": "Punica Editor",
   "private": false,
   "type": "module",

package/types/punica.module.kernel.policy.d.ts

@@ -38,6 +38,16 @@ declare module 'punica' {
        * remote` reaches exactly the requests that carry this.
        */
       egress?: 'remote';
+      /**
+       * `'declared'` when the capability classifies itself or this call's
+       * input as sensitive (`dataClassification: 'sensitive'`, or a value
+       * at a schema path annotated `sensitive: true`), `'taint'` when a
+       * call earlier in the same trace read something declared sensitive
+       * and completed — as `egressGuard` resolved it. A rule with
+       * `sensitive: true` reaches exactly the requests that carry this
+       * (`docs/sensitive-data-egress.md` T2, T3).
+       */
+      sensitive?: 'declared' | 'taint';
       risk: PolicyRisk;
       approval: PolicyApproval;
       /**
@@ -563,6 +573,14 @@ declare module 'punica' {
        * (`docs/sensitive-data-egress.md`). The only value is `remote`.
        */
       egress?: 'remote';
+      /**
+       * Selects the calls that carry sensitive material — by the
+       * capability's declaration or by the run's taint, as the gate
+       * resolved it. The only value is `true`; written beside `egress:
+       * remote`, `deny` is the sentence "sensitive data does not leave this
+       * machine" while other remote calls still may.
+       */
+      sensitive?: true;
       effect: PolicyRuleEffect;
       /** ANDed. Absent or empty matches every argument tuple. */
       when?: PolicyCondition[];
@@ -616,6 +634,8 @@ declare module 'punica' {
       org?: string;
       /** The rule's `signatures`, when more than one. */
       signatures?: number;
+      /** The rule's `sensitive: true`, when it wrote it. */
+      sensitive?: true;
       /** Digest of the template's rules — which policy text was in force. */
       digest?: string;
       /**
@@ -623,7 +643,7 @@ declare module 'punica' {
        * declares. A reader of the audit record can otherwise not tell
        * why a rule naming no id applied to this call.
        */
-      matchedBy?: 'id' | 'action' | 'egress';
+      matchedBy?: 'id' | 'action' | 'egress' | 'sensitive';
     }
 
     /** A rule that matched, plus the rule itself for the caller to read. */