veto-sdk 1.17.0 → 2.2.0

package/README.md

@@ -1,20 +1,23 @@
-# Veto
+# veto-sdk
 
-A guardrail system for AI agent tool calls. Veto intercepts and validates tool calls made by AI models before execution.
+[![npm](https://img.shields.io/npm/v/veto-sdk?color=000000)](https://www.npmjs.com/package/veto-sdk)
+[![License](https://img.shields.io/badge/license-Apache%202.0-blue.svg)](../../LICENSE)
 
-## How It Works
+A guardrail system for AI agent tool calls. Veto intercepts and validates tool calls made by AI models before execution — blocking, allowing, or routing to human approval.
 
-1. **Initialize** Veto.
-2. **Wrap** your tools using `veto.wrap()`.
-3. **Pass** the wrapped tools to your AI agent/model.
+## How it works
 
-When the AI model calls a tool, Veto automatically:
+1. **Initialize** Veto (loads your YAML rules).
+2. **Wrap** your tools with `veto.wrap()`.
+3. **Pass** the wrapped tools to your agent — types preserved, interface unchanged.
+
+When the AI calls a tool, Veto automatically:
 
 1. Intercepts the call.
-2. Validates arguments against your rules (via YAML & LLM).
-3. Blocks or Allows execution based on the result.
+2. Validates arguments against your rules (deterministic conditions first, optional LLM for semantic rules).
+3. **allow** → executes · **block** → denied with reason · **ask** → approval queue.
 
-The AI model remains unaware of the guardrail - the tool interface is preserved.
+The agent is unaware of the guardrail.
 
 ## Installation
 
@@ -22,51 +25,41 @@ The AI model remains unaware of the guardrail - the tool interface is preserved.
 npm install veto-sdk
 ```
 
-For a complete bank transfer escalation example, see the [HITL guide](../../docs/hitl-guide.md).
+For a complete human-in-the-loop example, see the [HITL guide](../../docs/hitl-guide.md).
 
-## Quick Start
+## Quick start
 
 ### 1. Initialize Veto
 
-Run the CLI to create configuration:
-
 ```bash
 npx veto init
 ```
 
-This creates a `veto/` directory with `veto.config.yaml` and default rules.
+Creates `./veto/veto.config.yaml` and default rules.
 
-### 2. Wrap Your Tools
+### 2. Wrap your tools
 
-Veto's `wrap()` method is provider-agnostic. It works with LangChain, Vercel AI SDK, or any custom tool object.
+`wrap()` is provider-agnostic — works with LangChain, Vercel AI SDK, or any custom tool object.
 
 ```typescript
 import { Veto } from 'veto-sdk';
-import { tool } from '@langchain/core/tools'; // Example with LangChain
+import { tool } from '@langchain/core/tools';
 
-// 1. Define your tools normally
 const myTools = [
-  tool(async (args) => { ... }, { name: 'my_tool', ... }),
-  // ...
+  tool(async (args) => { /* ... */ }, { name: 'my_tool', /* ... */ }),
 ];
 
-// 2. Initialize Veto
 const veto = await Veto.init();
 
-// 3. Wrap tools (Validation logic is injected)
-// Types are preserved: wrappedTools has same type as myTools
+// Types are preserved: wrappedTools has the same type as myTools
 const wrappedTools = veto.wrap(myTools);
 
-// 4. Pass to your Agent/LLM
-const agent = createAgent({
-  tools: wrappedTools,
-  // ...
-});
+const agent = createAgent({ tools: wrappedTools });
 ```
 
-### 3. Configure Rules
+### 3. Configure rules
 
-Edit `veto/rules/financial.yaml` (example):
+Edit `veto/rules/financial.yaml`:
 
 ```yaml
 rules:
@@ -88,38 +81,33 @@ rules:
 ```yaml
 version: "1.0"
 
-# Operating mode
-mode: "strict" # "strict" blocks calls, "log" only logs them
+# "strict" blocks calls, "log" only logs them
+mode: "strict"
 
-# Validation Backend
+# Validation backend
 validation:
-  mode: "custom" # "api", "kernel", or "custom"
+  mode: "custom"   # "api", "kernel", or "custom"
 
-# Custom Provider (if mode is custom)
+# Custom provider (if mode is custom)
 custom:
-  provider: "gemini" # or openai, anthropic
+  provider: "gemini"   # openai | anthropic | gemini
   model: "gemini-3-flash-preview"
 
-# Logging
 logging:
   level: "info"
 
-# Rules
 rules:
   directory: "./rules"
   recursive: true
-# Local approval callback (for action: require_approval)
+
+# Human-in-the-loop approval (for action: ask)
 # approval:
 #   callbackUrl: "http://localhost:8787/approvals"
 #   timeout: 30000
-#   timeoutBehavior: "block" # "block" (default) or "allow"
-#   includeCustomContext: false # opt-in: forward validation context.custom to webhook
-#   responseSchema:
-#     decisionField: "decision"
-#     reasonField: "reason"
+#   timeoutBehavior: "block"
 ```
 
-## API Reference
+## API reference
 
 ### `Veto.init(options?)`
 
@@ -131,16 +119,16 @@ const veto = await Veto.init();
 
 ### `veto.wrap<T>(tools: T[]): T[]`
 
-Wraps an array of tools. The returned tools have Veto validation injected into their execution handler. Preserves the original tool types for full compatibility with your AI framework.
+Wrap an array of tools. Injects Veto validation into each tool's execution handler. Preserves types for full framework compatibility.
 
 ```typescript
 const wrappedForLangChain = veto.wrap(langChainTools);
-const wrappedForVercel = veto.wrap(vercelTools);
+const wrappedForVercel    = veto.wrap(vercelTools);
 ```
 
 ### `veto.wrapTool<T>(tool: T): T`
 
-Wraps a single tool instance.
+Wrap a single tool.
 
 ```typescript
 const safeTool = veto.wrapTool(myTool);
@@ -148,191 +136,69 @@ const safeTool = veto.wrapTool(myTool);
 
 ### `veto.getHistoryStats()`
 
-Returns statistics about allowed vs blocked calls.
+Statistics on allowed vs blocked calls.
 
 ```typescript
 const stats = veto.getHistoryStats();
-console.log(stats);
 // { totalCalls: 5, allowedCalls: 4, deniedCalls: 1, ... }
 ```
 
 ### `veto.clearHistory()`
 
-Resets the history statistics.
-
-```typescript
-veto.clearHistory();
-```
+Reset history statistics.
 
 ### `veto.exportDecisions(format)`
 
-Exports decision history as JSON or CSV.
+Export decision history as JSON or CSV.
 
 ```typescript
-const jsonAudit = veto.exportDecisions("json");
-const csvAudit = veto.exportDecisions("csv");
-```
-
-## CLI Commands
-
-Canonical package:
-
-```bash
-npx veto-cli@latest
-```
-
-Compatibility package (still supported):
-
-```bash
-npx veto-sdk@latest
+const json = veto.exportDecisions("json");
+const csv  = veto.exportDecisions("csv");
 ```
 
-| Command                                                                               | Description                                     |
-| ------------------------------------------------------------------------------------- | ----------------------------------------------- |
-| `veto`                                                                                | Start Veto Studio (default interactive mode)    |
-| `veto studio`                                                                         | Start Veto Studio explicitly                    |
-| `veto repl --legacy`                                                                  | Start legacy line-based REPL                    |
-| `veto policy generate --tool <name> --prompt <text> [--target local\|cloud] [--json]` | Generate policy YAML (interactive-independent)  |
-| `veto policy apply --file <path> [--target local\|cloud] [--json]`                    | Apply policy file locally or create cloud draft |
-| `veto guard check --tool <name> --args <json> [--mode ...] [--json]`                  | Run a deterministic guard check for a tool call |
-| `veto cloud login`                                                                    | Start cloud device login                        |
-| `veto cloud whoami`                                                                   | Show cloud CLI context                          |
-| `veto doctor`                                                                         | Runtime/auth/connectivity diagnostics           |
-| `veto init`, `veto learn`, `veto compile`, `veto test`, `veto scan`, `veto diff`      | Existing core workflows                         |
-| `veto version`                                                                        | Show version                                    |
-
-Migration notes:
-
-- Legacy REPL is still available via `veto repl --legacy`.
-- `veto-cli` is the canonical package. `veto-sdk` CLI path remains compatibility-first.
-- Studio template fallback is opt-in (`--demo-template` or `studio.generation.allowTemplateFallback: true`).
-- Studio defaults to Ink on Node.js. OpenTUI remains optional (`--renderer opentui`) for Bun runtimes.
-
-Veto Studio examples:
+## CLI commands
 
 ```bash
-# Start full-screen Veto Studio
-npx veto-cli@latest
-
-# Start Studio with explicit flag
-npx veto-cli@latest studio
-
-# Force ANSI renderer
-npx veto-cli@latest studio --renderer ansi
-
-# Open a specific workspace from multi-repo root
-npx veto-cli@latest studio --directory ./packages/sdk
-
-# Enable explicit template demo mode (otherwise no silent fallback in Studio)
-npx veto-cli@latest studio --demo-template
-
-# Legacy line-based REPL remains available
-npx veto-cli@latest repl --legacy
+npx veto-cli@latest                                   # Veto Studio (interactive TUI)
+npx veto-cli@latest policy generate --tool <name> --prompt <text>
+npx veto-cli@latest guard check --tool <name> --args <json> --json
+npx veto-cli@latest scan --fail-uncovered             # CI gate
 ```
 
-Legacy REPL slash-command examples:
+→ [Full CLI reference](../cli/README.md)
 
-```bash
-# Test a call locally (no network)
-/test transfer_funds({"amount": 50000})
-
-# Ask a what-if question in plain language
-what would happen if my agent tried to transfer $50,000?
-
-# Explain a rule
-/explain fin-block-high-transfers
-
-# Run scenario suite
-test my agent against current rules
-
-# Export merged rules
-/export
-```
-
-Coverage audit examples:
-
-```bash
-# Human-readable coverage report
-npx veto scan
-
-# Scan an explicit workspace directory
-npx veto scan --directory ./packages/sdk
-
-# Include examples/ and tests/ directories in scan scope
-npx veto scan --include-examples --include-tests
-
-# CI gate: fail when uncovered tools are found
-npx veto scan --fail-uncovered
-
-# Include inline YAML snippets for uncovered tools
-npx veto scan --suggest
-
-# Machine-readable output for CI pipelines
-npx veto scan --format json
-```
-
-Policy diff examples:
-
-```bash
-# Compare working rule file against HEAD (git snapshot)
-npx veto diff financial.yaml
-
-# Compare two explicit snapshots (file or directory mode)
-npx veto diff --old ./rules-v1 --new ./rules-v2
-
-# Include deterministic replay impact from historical calls
-npx veto diff financial.yaml --log calls.jsonl
-
-# Machine-readable structural + impact report
-npx veto diff --old ./rules-v1 --new ./rules-v2 --log calls.jsonl --format json
-```
-
-## General Rule YAML Format
-
-Each rule file (e.g., `veto/rules/policy.yaml`) can contain one or more rules.
+## Rule YAML format
 
 ```yaml
 rules:
-  - id: unique-rule-id # [Required] Unique identifier for the rule
-    name: Human readable name # [Required] Descriptive name for logging
-    enabled: true # [Optional] Default: true
-    severity: high # [Optional] critical, high, medium, low, info. Default: medium
-    action: block # [Required] block, warn, log, allow, require_approval.
-
-    # Scope: Which tools does this rule apply to?
-    tools: # [Optional] List of tool names.
-      - make_payment # If omitted or empty, applies to ALL tools (Global Rule).
-
-    # Static Conditions (Optional):
-    # Evaluated locally before LLM validation. Fast checks for specific values.
+  - id: unique-rule-id          # required
+    name: Human readable name   # required
+    enabled: true               # optional, default: true
+    severity: high              # critical | high | medium | low | info
+    action: block               # block | warn | log | allow | ask
+
+    # Scope: which tools does this rule apply to?
+    # Omit or leave empty to apply to ALL tools (global rule).
+    tools:
+      - make_payment
+
+    # Static conditions (optional) — evaluated locally, zero latency
     conditions:
-      - field: arguments.amount # Dot notation for nested arguments
-        operator: greater_than # equals, contains, starts_with, ends_with, greater_than, less_than
+      - field: arguments.amount     # dot notation for nested args
+        operator: greater_than      # equals | contains | starts_with | ends_with | greater_than | less_than
         value: 1000
 
-    # description (Optional):
-    # Natural language guidance for the validation LLM.
+    # Semantic guidance for LLM validation (optional)
     description: "Ensure the payment recipient is a verified vendor."
 ```
 
-## Rule Matching Logic
-
-Veto uses a two-step process to determine if a tool call is safe:
-
-### 1. Rule Selection (Which rules apply?)
-
-Veto selects rules based on the `tools` list in your YAML:
-
-- **Tool-Specific Rules**: If a rule lists specific tools (e.g., `tools: [make_payment]`), it ONLY applies when those tools are called.
-- **Global Rules**: If `tools` is missing or empty `[]`, the rule activates for **EVERY** tool call. Use this for universal policies (e.g., "Do not reveal internal file paths").
-
-### 2. Validation Execution
+## Rule matching logic
 
-For each intercepted tool call, Veto aggregates all applicable rules (Global + Specific) and validates them:
+Veto uses a two-step process:
 
-- **Static Conditions**: If `conditions` are defined, they are checked first by the Validation Engine. If a condition matches (e.g., `amount > 1000`), the rule triggers immediately.
-- **Semantic Validation**: If no static conditions are matched (or none exist), the rule's `name` and `description` are passed to the LLM (via API, Kernel, or Custom provider) to semantically verify if the tool call violates the rule context.
+1. **Rule selection** — rules with a matching `tools` list apply. Rules with no `tools` (global rules) apply to every call.
+2. **Validation** — static `conditions` are checked first (local, no API call). If conditions match, the rule triggers immediately. Otherwise, the rule's `name` and `description` are sent to the LLM for semantic validation.
 
 ## License
 
-MIT
+Apache-2.0 © [Plaw, Inc.](https://plaw.io)

package/dist/browser/index.d.ts

@@ -1,7 +1,7 @@
 import { Veto } from './veto.js';
 export { protect, type ProtectOptions, type ProtectMode, } from './protect.js';
 export { Veto };
-export type { VetoBrowserOptions, GuardResult, GuardContext, } from './types.js';
+export type { VetoBrowserOptions, VetoFromCloudOptions, VetoMode, GuardResult, GuardContext, } from './types.js';
 export type { Rule, OutputRule, RuleCondition, RuleSeverity, RuleAction, } from '../rules/types.js';
 export type { OutputValidationResult } from '../core/output-validator.js';
 export { ToolCallDeniedError } from '../core/interceptor.js';

package/dist/browser/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/browser/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC,OAAO,EACL,OAAO,EACP,KAAK,cAAc,EACnB,KAAK,WAAW,GACjB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,IAAI,EAAE,CAAC;AAChB,YAAY,EACV,kBAAkB,EAClB,WAAW,EACX,YAAY,GACb,MAAM,YAAY,CAAC;AACpB,YAAY,EACV,IAAI,EACJ,UAAU,EACV,aAAa,EACb,YAAY,EACZ,UAAU,GACX,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAC1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,EAAE,4BAA4B,EAAE,MAAM,iCAAiC,CAAC;AAoB/E,wBAAgB,UAAU,CAAC,CAAC,EAC1B,IAAI,EAAE,IAAI,EACV,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,GACzD,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,CAW/C;AAED,wBAAgB,WAAW,CACzB,IAAI,EAAE,IAAI,EACV,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,GAClE,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC,CAYrE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/browser/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC,OAAO,EACL,OAAO,EACP,KAAK,cAAc,EACnB,KAAK,WAAW,GACjB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,IAAI,EAAE,CAAC;AAChB,YAAY,EACV,kBAAkB,EAClB,oBAAoB,EACpB,QAAQ,EACR,WAAW,EACX,YAAY,GACb,MAAM,YAAY,CAAC;AACpB,YAAY,EACV,IAAI,EACJ,UAAU,EACV,aAAa,EACb,YAAY,EACZ,UAAU,GACX,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAC1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,EAAE,4BAA4B,EAAE,MAAM,iCAAiC,CAAC;AAoB/E,wBAAgB,UAAU,CAAC,CAAC,EAC1B,IAAI,EAAE,IAAI,EACV,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,GACzD,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,CAW/C;AAED,wBAAgB,WAAW,CACzB,IAAI,EAAE,IAAI,EACV,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,GAClE,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC,CAYrE"}

package/dist/browser/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/browser/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAE7D,OAAO,EACL,OAAO,GAGR,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,IAAI,EAAE,CAAC;AAchB,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,EAAE,4BAA4B,EAAE,MAAM,iCAAiC,CAAC;AAE/E,SAAS,wBAAwB,CAC/B,MAA0C;IAE1C,MAAM,QAAQ,GAAiC,MAAM,CAAC,QAAQ,KAAK,kBAAkB;QACnF,CAAC,CAAC,kBAAkB;QACpB,CAAC,CAAC,MAAM,CAAC;IAEX,OAAO;QACL,QAAQ;QACR,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,QAAQ,EAAE;YACR,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,UAAU,EAAE,MAAM,CAAC,UAAU;SAC9B;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,UAAU,CACxB,IAAU,EACV,QAAgB,EAChB,OAA0D;IAE1D,OAAO,KAAK,EAAE,IAAI,EAAE,EAAE;QACpB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAChD,IACE,CAAC,MAAM,CAAC,QAAQ,KAAK,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,kBAAkB,CAAC;eACnE,MAAM,CAAC,MAAM,KAAK,IAAI,EACzB,CAAC;YACD,MAAM,IAAI,mBAAmB,CAAC,QAAQ,EAAE,OAAO,EAAE,wBAAwB,CAAC,MAAM,CAAC,CAAC,CAAC;QACrF,CAAC;QACD,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,WAAW,CACzB,IAAU,EACV,OAAmE;IAEnE,MAAM,OAAO,GAAwE,EAAE,CAAC;IAExF,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACtD,OAAO,CAAC,IAAI,CAAC,GAAG,UAAU,CACxB,IAAI,EACJ,IAAI,EACJ,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CACpC,CAAC;IACJ,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/browser/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAE7D,OAAO,EACL,OAAO,GAGR,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,IAAI,EAAE,CAAC;AAgBhB,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,EAAE,4BAA4B,EAAE,MAAM,iCAAiC,CAAC;AAE/E,SAAS,wBAAwB,CAC/B,MAA0C;IAE1C,MAAM,QAAQ,GAAiC,MAAM,CAAC,QAAQ,KAAK,kBAAkB;QACnF,CAAC,CAAC,kBAAkB;QACpB,CAAC,CAAC,MAAM,CAAC;IAEX,OAAO;QACL,QAAQ;QACR,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,QAAQ,EAAE;YACR,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,UAAU,EAAE,MAAM,CAAC,UAAU;SAC9B;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,UAAU,CACxB,IAAU,EACV,QAAgB,EAChB,OAA0D;IAE1D,OAAO,KAAK,EAAE,IAAI,EAAE,EAAE;QACpB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAChD,IACE,CAAC,MAAM,CAAC,QAAQ,KAAK,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,kBAAkB,CAAC;eACnE,MAAM,CAAC,MAAM,KAAK,IAAI,EACzB,CAAC;YACD,MAAM,IAAI,mBAAmB,CAAC,QAAQ,EAAE,OAAO,EAAE,wBAAwB,CAAC,MAAM,CAAC,CAAC,CAAC;QACrF,CAAC;QACD,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,WAAW,CACzB,IAAU,EACV,OAAmE;IAEnE,MAAM,OAAO,GAAwE,EAAE,CAAC;IAExF,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACtD,OAAO,CAAC,IAAI,CAAC,GAAG,UAAU,CACxB,IAAI,EACJ,IAAI,EACJ,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CACpC,CAAC;IACJ,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/browser/types.d.ts

@@ -1,4 +1,4 @@
-import type { LogLevel, NamedValidator, ValidationContext, Validator } from '../types/config.js';
+import type { LogLevel, NamedValidator, StreamLogMode, ValidationContext, Validator } from '../types/config.js';
 import type { OutputRule, Rule, RuleSeverity } from '../rules/types.js';
 import type { BudgetConfig, ToolCostMap } from '../core/budget.js';
 export type VetoMode = 'strict' | 'log' | 'shadow';
@@ -41,6 +41,8 @@ export interface VetoBrowserOptions<TCloudClient = BrowserCloudClient> {
     outputRules?: OutputRule[];
     mode?: VetoMode;
     logLevel?: LogLevel;
+    stream?: boolean;
+    streamMode?: StreamLogMode;
     sessionId?: string;
     agentId?: string;
     userId?: string;
@@ -52,10 +54,24 @@ export interface VetoBrowserOptions<TCloudClient = BrowserCloudClient> {
     onApprovalRequired?: (context: ValidationContext, approvalId: string) => void | Promise<void>;
     budget?: BudgetConfig;
     costs?: ToolCostMap;
+    /** Callback fired after every guard() invocation. Enables UI logging, audit trails, analytics. */
+    onDecisionMade?: (result: GuardResult & {
+        toolName: string;
+    }) => void;
 }
 export interface VetoFromCloudOptions {
     apiKey: string;
     endpoint?: string;
     refreshIntervalMs?: number;
+    mode?: VetoMode;
+    logLevel?: LogLevel;
+    sessionId?: string;
+    agentId?: string;
+    userId?: string;
+    role?: string;
+    validators?: (Validator | NamedValidator)[];
+    onApprovalRequired?: (context: ValidationContext, approvalId: string) => void | Promise<void>;
+    budget?: BudgetConfig;
+    costs?: ToolCostMap;
 }
 //# sourceMappingURL=types.d.ts.map

package/dist/browser/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/browser/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,QAAQ,EACR,cAAc,EACd,iBAAiB,EACjB,SAAS,EACV,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACxE,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEnE,MAAM,MAAM,QAAQ,GAAG,QAAQ,GAAG,KAAK,GAAG,QAAQ,CAAC;AAEnD,MAAM,WAAW,YAAY;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,kBAAkB,CAAC;IAChD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,EAAE,IAAI,EAAE,CAAC;IACjB,WAAW,CAAC,EAAE,UAAU,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,2BAA2B;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,QAAQ,EAAE,OAAO,GAAG,MAAM,CAAC;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,eAAe,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,QAAQ,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,kBAAkB;IACjC,aAAa,EAAE,MAAM,OAAO,CAAC,4BAA4B,CAAC,CAAC;IAC3D,WAAW,EAAE,CAAC,OAAO,EAAE,2BAA2B,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5E,OAAO,CAAC,EAAE,MAAM,IAAI,CAAC;CACtB;AAED,MAAM,WAAW,kBAAkB,CAAC,YAAY,GAAG,kBAAkB;IACnE,KAAK,EAAE,IAAI,EAAE,CAAC;IACd,WAAW,CAAC,EAAE,UAAU,EAAE,CAAC;IAC3B,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,CAAC,SAAS,GAAG,cAAc,CAAC,EAAE,CAAC;IAC5C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,YAAY,CAAC;IAC3B,kBAAkB,CAAC,EAAE,CACnB,OAAO,EAAE,iBAAiB,EAC1B,UAAU,EAAE,MAAM,KACf,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,KAAK,CAAC,EAAE,WAAW,CAAC;CACrB;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/browser/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,QAAQ,EACR,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,SAAS,EACV,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACxE,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEnE,MAAM,MAAM,QAAQ,GAAG,QAAQ,GAAG,KAAK,GAAG,QAAQ,CAAC;AAEnD,MAAM,WAAW,YAAY;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,kBAAkB,CAAC;IAChD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,EAAE,IAAI,EAAE,CAAC;IACjB,WAAW,CAAC,EAAE,UAAU,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,2BAA2B;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,QAAQ,EAAE,OAAO,GAAG,MAAM,CAAC;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,eAAe,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,QAAQ,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,kBAAkB;IACjC,aAAa,EAAE,MAAM,OAAO,CAAC,4BAA4B,CAAC,CAAC;IAC3D,WAAW,EAAE,CAAC,OAAO,EAAE,2BAA2B,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5E,OAAO,CAAC,EAAE,MAAM,IAAI,CAAC;CACtB;AAED,MAAM,WAAW,kBAAkB,CAAC,YAAY,GAAG,kBAAkB;IACnE,KAAK,EAAE,IAAI,EAAE,CAAC;IACd,WAAW,CAAC,EAAE,UAAU,EAAE,CAAC;IAC3B,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,UAAU,CAAC,EAAE,aAAa,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,CAAC,SAAS,GAAG,cAAc,CAAC,EAAE,CAAC;IAC5C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,YAAY,CAAC;IAC3B,kBAAkB,CAAC,EAAE,CACnB,OAAO,EAAE,iBAAiB,EAC1B,UAAU,EAAE,MAAM,KACf,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,kGAAkG;IAClG,cAAc,CAAC,EAAE,CAAC,MAAM,EAAE,WAAW,GAAG;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;CACvE;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,CAAC,SAAS,GAAG,cAAc,CAAC,EAAE,CAAC;IAC5C,kBAAkB,CAAC,EAAE,CACnB,OAAO,EAAE,iBAAiB,EAC1B,UAAU,EAAE,MAAM,KACf,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,KAAK,CAAC,EAAE,WAAW,CAAC;CACrB"}

package/dist/browser/veto.d.ts

@@ -1,4 +1,5 @@
 import type { ValidationResult } from '../types/config.js';
+import type { OutputRule, Rule } from '../rules/types.js';
 import { type HistoryStats } from '../core/history.js';
 import { type BudgetStatus } from '../core/budget.js';
 import { type OutputValidationResult } from '../core/output-validator.js';
@@ -17,7 +18,12 @@ export declare class Veto {
     private readonly outputValidator;
     private readonly cloudClient;
     private readonly onApprovalRequired?;
+    private readonly onDecisionMade?;
     private rulesState;
+    private cloudRules;
+    private cloudOutputRules;
+    private localRules;
+    private localOutputRules;
     private readonly compiledExpressionCache;
     private refreshIntervalId;
     private constructor();
@@ -65,6 +71,10 @@ export declare class Veto {
     }>(tool: T): T;
     validateOutput(toolName: string, output: unknown): OutputValidationResult;
     refreshRules(): Promise<void>;
+    addRules(rules: Rule[], outputRules?: OutputRule[]): void;
+    removeRule(ruleId: string): void;
+    getRules(): Rule[];
+    private reindex;
     getHistoryStats(): HistoryStats;
     clearHistory(): void;
     getBudgetStatus(): BudgetStatus | null;

package/dist/browser/veto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"veto.d.ts","sourceRoot":"","sources":["../../src/browser/veto.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAGV,gBAAgB,EAEjB,MAAM,oBAAoB,CAAC;AAO5B,OAAO,EAAkB,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvE,OAAO,EAAiB,KAAK,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACrE,OAAO,EAAmB,KAAK,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAC3F,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,KAAK,EAIV,YAAY,EACZ,WAAW,EACX,kBAAkB,EAClB,oBAAoB,EAErB,MAAM,YAAY,CAAC;AAmOpB,qBAAa,IAAI;IACf,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAW;IAChC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAmB;IAC9C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAiB;IAChD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAuB;IACrD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAkB;IAClD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA4B;IACxD,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAGV;IAE1B,OAAO,CAAC,UAAU,CAAmB;IACrC,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAA8B;IACtE,OAAO,CAAC,iBAAiB,CAA+C;IAExE,OAAO;IAmCP,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,kBAAkB,GAAG,IAAI;WAKtC,SAAS,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC;IAkBpE,OAAO,CAAC,kBAAkB;IAmB1B,OAAO,CAAC,eAAe;IAKvB,OAAO,CAAC,qBAAqB;IAK7B,OAAO,CAAC,gBAAgB;IAIxB,OAAO,CAAC,cAAc;IAItB,OAAO,CAAC,aAAa;IAIrB,OAAO,CAAC,WAAW;IAInB,OAAO,CAAC,sBAAsB;IAI9B,OAAO,CAAC,mBAAmB;IAiC3B,OAAO,CAAC,cAAc;IAStB,OAAO,CAAC,mBAAmB;IAI3B,OAAO,CAAC,iBAAiB;IAYzB,OAAO,CAAC,kBAAkB;IAsB1B,OAAO,CAAC,sBAAsB;IAgB9B,OAAO,CAAC,aAAa;YAmHP,aAAa;IAmB3B,OAAO,CAAC,aAAa;IAwCrB,OAAO,CAAC,cAAc;IAoChB,KAAK,CACT,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,OAAO,GAAE,YAAiB,GACzB,OAAO,CAAC,WAAW,CAAC;IA4BjB,gBAAgB,CAAC,IAAI,EAAE;QAC3B,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,IAAI,EAAE,MAAM,CAAC;QACb,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACpC,GAAG,OAAO,CAAC;QACV,OAAO,EAAE,OAAO,CAAC;QACjB,gBAAgB,EAAE,gBAAgB,CAAC;QACnC,YAAY,EAAE;YAAE,EAAE,CAAC,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;SAAE,CAAC;QAChF,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACzC,CAAC;YAwBY,oBAAoB;IAqBlC,IAAI,CAAC,CAAC,SAAS;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE;IAIjD,QAAQ,CAAC,CAAC,SAAS;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC;IA8EhD,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,sBAAsB;IAInE,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;IAUnC,eAAe,IAAI,YAAY;IAI/B,YAAY,IAAI,IAAI;IAIpB,eAAe,IAAI,YAAY,GAAG,IAAI;IAItC,WAAW,IAAI,IAAI;IAInB,OAAO,IAAI,IAAI;CAQhB;AAED,OAAO,EAAE,mBAAmB,EAAE,CAAC"}
+{"version":3,"file":"veto.d.ts","sourceRoot":"","sources":["../../src/browser/veto.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAGV,gBAAgB,EAEjB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,UAAU,EAAE,IAAI,EAAgB,MAAM,mBAAmB,CAAC;AAMxE,OAAO,EAAkB,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvE,OAAO,EAAiB,KAAK,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACrE,OAAO,EAAmB,KAAK,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAC3F,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,KAAK,EAIV,YAAY,EACZ,WAAW,EACX,kBAAkB,EAClB,oBAAoB,EAErB,MAAM,YAAY,CAAC;AAmOpB,qBAAa,IAAI;IACf,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAW;IAChC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAmB;IAC9C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAiB;IAChD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAuB;IACrD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAkB;IAClD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA4B;IACxD,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAGV;IAC1B,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAuD;IAEvF,OAAO,CAAC,UAAU,CAAmB;IACrC,OAAO,CAAC,UAAU,CAAc;IAChC,OAAO,CAAC,gBAAgB,CAAoB;IAC5C,OAAO,CAAC,UAAU,CAAc;IAChC,OAAO,CAAC,gBAAgB,CAAoB;IAC5C,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAA8B;IACtE,OAAO,CAAC,iBAAiB,CAA+C;IAExE,OAAO;IAsCP,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,kBAAkB,GAAG,IAAI;WAKtC,SAAS,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC;IA4BpE,OAAO,CAAC,kBAAkB;IAmB1B,OAAO,CAAC,eAAe;IAKvB,OAAO,CAAC,qBAAqB;IAK7B,OAAO,CAAC,gBAAgB;IAIxB,OAAO,CAAC,cAAc;IAItB,OAAO,CAAC,aAAa;IAIrB,OAAO,CAAC,WAAW;IAInB,OAAO,CAAC,sBAAsB;IAI9B,OAAO,CAAC,mBAAmB;IAiC3B,OAAO,CAAC,cAAc;IAStB,OAAO,CAAC,mBAAmB;IAI3B,OAAO,CAAC,iBAAiB;IAYzB,OAAO,CAAC,kBAAkB;IAsB1B,OAAO,CAAC,sBAAsB;IAgB9B,OAAO,CAAC,aAAa;YAmHP,aAAa;IAmB3B,OAAO,CAAC,aAAa;IAwCrB,OAAO,CAAC,cAAc;IAoChB,KAAK,CACT,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,OAAO,GAAE,YAAiB,GACzB,OAAO,CAAC,WAAW,CAAC;IAqCjB,gBAAgB,CAAC,IAAI,EAAE;QAC3B,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,IAAI,EAAE,MAAM,CAAC;QACb,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACpC,GAAG,OAAO,CAAC;QACV,OAAO,EAAE,OAAO,CAAC;QACjB,gBAAgB,EAAE,gBAAgB,CAAC;QACnC,YAAY,EAAE;YAAE,EAAE,CAAC,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;SAAE,CAAC;QAChF,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACzC,CAAC;YAwBY,oBAAoB;IAqBlC,IAAI,CAAC,CAAC,SAAS;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE;IAIjD,QAAQ,CAAC,CAAC,SAAS;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC;IA8EhD,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,sBAAsB;IAInE,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;IAWnC,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,WAAW,CAAC,EAAE,UAAU,EAAE,GAAG,IAAI;IAwBzD,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAMhC,QAAQ,IAAI,IAAI,EAAE;IAIlB,OAAO,CAAC,OAAO;IAQf,eAAe,IAAI,YAAY;IAI/B,YAAY,IAAI,IAAI;IAIpB,eAAe,IAAI,YAAY,GAAG,IAAI;IAItC,WAAW,IAAI,IAAI;IAInB,OAAO,IAAI,IAAI;CAQhB;AAED,OAAO,EAAE,mBAAmB,EAAE,CAAC"}

package/dist/browser/veto.js

@@ -88,7 +88,7 @@ function normalizePoliciesResponse(payload) {
     };
 }
 function createInlineCloudClient(apiKey, endpoint, logger) {
-    const baseUrl = (endpoint ?? 'https://api.runveto.com').replace(/\/$/, '');
+    const baseUrl = (endpoint ?? 'https://api.veto.so').replace(/\/$/, '');
     const headers = {
         'Content-Type': 'application/json',
         'X-Veto-API-Key': apiKey,
@@ -198,7 +198,12 @@ export class Veto {
     outputValidator;
     cloudClient;
     onApprovalRequired;
+    onDecisionMade;
     rulesState;
+    cloudRules = [];
+    cloudOutputRules = [];
+    localRules = [];
+    localOutputRules = [];
     compiledExpressionCache = new Map();
     refreshIntervalId = null;
     constructor(options, logger) {
@@ -209,11 +214,14 @@ export class Veto {
         this.userId = options.userId;
         this.role = options.role;
         this.validators = toNamedValidators(options.validators);
-        this.rulesState = indexRules(options.rules, options.outputRules ?? []);
+        this.cloudRules = options.rules;
+        this.cloudOutputRules = options.outputRules ?? [];
+        this.rulesState = indexRules(this.cloudRules, this.cloudOutputRules);
         this.cloudClient = options.cloudClient ?? (options.apiKey
             ? createInlineCloudClient(options.apiKey, options.endpoint, logger)
             : null);
         this.onApprovalRequired = options.onApprovalRequired;
+        this.onDecisionMade = options.onDecisionMade;
         this.historyTracker = new HistoryTracker({
             maxSize: 100,
             logger: this.logger,
@@ -235,12 +243,22 @@ export class Veto {
         return new Veto(options, logger);
     }
     static async fromCloud(options) {
-        const logger = createLogger('warn');
+        const logger = createLogger(options.logLevel ?? 'warn');
         const cloudClient = createInlineCloudClient(options.apiKey, options.endpoint, logger);
         const policies = await cloudClient.fetchPolicies();
         const veto = Veto.fromRules({
             rules: policies.policies,
             outputRules: policies.outputRules,
+            mode: options.mode,
+            logLevel: options.logLevel,
+            sessionId: options.sessionId,
+            agentId: options.agentId,
+            userId: options.userId,
+            role: options.role,
+            validators: options.validators,
+            onApprovalRequired: options.onApprovalRequired,
+            budget: options.budget,
+            costs: options.costs,
             apiKey: options.apiKey,
             endpoint: options.endpoint,
             cloudClient,
@@ -536,7 +554,17 @@ export class Veto {
         const durationMs = Date.now() - start;
         this.historyTracker.record(toolName, args, result, durationMs);
         this.reportDecision(validationContext, result, durationMs);
-        return this.toGuardResult(result);
+        const guardResult = this.toGuardResult(result);
+        try {
+            const maybePromise = this.onDecisionMade?.({ ...guardResult, toolName });
+            if (maybePromise && typeof maybePromise.catch === 'function') {
+                maybePromise.catch(() => { });
+            }
+        }
+        catch {
+            // swallow — callback errors must not break guard flow
+        }
+        return guardResult;
     }
     async validateToolCall(call) {
         const guardResult = await this.guard(call.name, call.arguments);
@@ -644,7 +672,43 @@ export class Veto {
             throw new Error('No cloud client configured');
         }
         const remote = await this.cloudClient.fetchPolicies();
-        this.rulesState = indexRules(remote.policies, remote.outputRules ?? []);
+        this.cloudRules = remote.policies;
+        this.cloudOutputRules = remote.outputRules ?? [];
+        this.reindex();
+    }
+    addRules(rules, outputRules) {
+        for (const rule of rules) {
+            const idx = this.localRules.findIndex(r => r.id === rule.id);
+            if (idx >= 0) {
+                this.localRules[idx] = rule;
+            }
+            else {
+                this.localRules.push(rule);
+            }
+        }
+        if (outputRules) {
+            for (const rule of outputRules) {
+                const idx = this.localOutputRules.findIndex(r => r.id === rule.id);
+                if (idx >= 0) {
+                    this.localOutputRules[idx] = rule;
+                }
+                else {
+                    this.localOutputRules.push(rule);
+                }
+            }
+        }
+        this.reindex();
+    }
+    removeRule(ruleId) {
+        this.localRules = this.localRules.filter(r => r.id !== ruleId);
+        this.localOutputRules = this.localOutputRules.filter(r => r.id !== ruleId);
+        this.reindex();
+    }
+    getRules() {
+        return [...this.rulesState.allRules];
+    }
+    reindex() {
+        this.rulesState = indexRules([...this.localRules, ...this.cloudRules], [...this.localOutputRules, ...this.cloudOutputRules]);
         this.compiledExpressionCache.clear();
     }
     getHistoryStats() {