veto-sdk 2.0.0 → 2.2.1

package/dist/core/veto.js

@@ -6,12 +6,14 @@
  *
  * @module core/veto
  */
-import { createLogger } from '../utils/logger.js';
+import { createLogger, } from '../utils/logger.js';
 import { generateId, generateToolCallId } from '../utils/id.js';
 import { ValidationEngine } from './validator.js';
 import { HistoryTracker } from './history.js';
 import { BudgetTracker, BudgetExceededError } from './budget.js';
 import { Interceptor, ToolCallDeniedError } from './interceptor.js';
+import { EconomicEvaluator } from '../economic/evaluator.js';
+import { LocalBudgetEngine } from '../economic/budget-engine.js';
 import { compile, evaluate } from '../compiler/index.js';
 import { evaluateConditionCollections } from '../rules/condition-evaluator.js';
 import { VetoCloudClient, ApprovalTimeoutError } from '../cloud/client.js';
@@ -52,6 +54,8 @@ export class Veto {
     validationEngine;
     historyTracker;
     budgetTracker;
+    economicEvaluator;
+    economicBudgetEngine;
     interceptor;
     outputValidator;
     eventWebhookEmitter;
@@ -82,6 +86,7 @@ export class Veto {
     approvalPollOptions;
     localApprovalConfig;
     onApprovalRequired;
+    onDecisionMade;
     // Approval preference cache: tool name -> 'approve_all' | 'deny_all'
     approvalPreferences = new Map();
     // Client-side deterministic validation cache
@@ -107,10 +112,18 @@ export class Veto {
             ? undefined
             : Veto.parseEnvMode(process.env.VETO_MODE);
         this.mode = options.mode ?? config.mode ?? envMode ?? 'strict';
+        const envLogSetting = this.browserMode
+            ? undefined
+            : Veto.parseEnvLogSetting(process.env.VETO_LOG);
         const envLogLevel = this.browserMode
             ? undefined
             : Veto.parseEnvLogLevel(process.env.VETO_LOG_LEVEL);
-        this.resolvedLogLevel = options.logLevel ?? envLogLevel ?? config.logging?.level ?? 'info';
+        const explicitLogLevel = Veto.resolveExplicitLogLevel(options);
+        this.resolvedLogLevel = explicitLogLevel
+            ?? envLogSetting?.level
+            ?? envLogLevel
+            ?? config.logging?.level
+            ?? 'info';
         const explicitValidationMode = config.validation?.mode;
         const cloudApiKey = options.apiKey
             ?? config.cloud?.apiKey
@@ -238,8 +251,9 @@ export class Veto {
                 reasonField: config.approval?.responseSchema?.reasonField ?? 'reason',
             },
         };
-        // Approval hook
+        // Hooks
         this.onApprovalRequired = options.onApprovalRequired;
+        this.onDecisionMade = options.onDecisionMade;
         this.eventWebhookEmitter = new EventWebhookEmitter(resolveEventWebhookConfig(config.events?.webhook, this.logger), this.logger);
         // Resolve tracking options
         const envSessionId = this.browserMode ? undefined : process.env.VETO_SESSION_ID;
@@ -327,6 +341,28 @@ export class Veto {
         else {
             this.budgetTracker = null;
         }
+        // Initialize economic evaluator (if configured)
+        if (config.economic?.budgets?.length) {
+            const localBudgetEngine = new LocalBudgetEngine({
+                budgets: config.economic.budgets,
+                logger: this.logger,
+            });
+            this.economicBudgetEngine = localBudgetEngine;
+            this.economicEvaluator = new EconomicEvaluator({
+                policy: config.economic,
+                budgetEngine: localBudgetEngine,
+                logger: this.logger,
+            });
+            this.logger.info('Economic authorization enabled', {
+                budgets: config.economic.budgets.length,
+                protocols: ['x402', 'mpp', 'ap2'],
+                payer_required: config.economic.payer?.required ?? false,
+            });
+        }
+        else {
+            this.economicEvaluator = null;
+            this.economicBudgetEngine = null;
+        }
         // Initialize interceptor
         this.outputValidator = new OutputValidator({
             logger: this.logger,
@@ -375,17 +411,28 @@ export class Veto {
         const parseYaml = await Veto.loadYamlParser();
         const configDir = pathModule.resolve(options.configDir ?? './veto');
         // Determine log level
-        const envLogLevel = process.env.VETO_LOG_LEVEL;
-        let logLevel = options.logLevel ?? envLogLevel ?? 'info';
+        const envLogSetting = Veto.parseEnvLogSetting(process.env.VETO_LOG);
+        const envLogLevel = Veto.parseEnvLogLevel(process.env.VETO_LOG_LEVEL);
+        const explicitLogLevel = Veto.resolveExplicitLogLevel(options);
+        let logLevel = explicitLogLevel ?? envLogSetting?.level ?? envLogLevel ?? 'info';
+        let streamMode = options.streamMode ?? envLogSetting?.streamMode ?? 'compact';
         // Load config file
         const configPath = pathModule.join(configDir, 'veto.config.yaml');
         let config = {};
         if (fsModule.existsSync(configPath)) {
             const configContent = fsModule.readFileSync(configPath, 'utf-8');
             config = parseYaml(configContent);
-            logLevel = options.logLevel ?? envLogLevel ?? config.logging?.level ?? 'info';
-        }
-        const logger = createLogger(logLevel);
+            logLevel = explicitLogLevel
+                ?? envLogSetting?.level
+                ?? envLogLevel
+                ?? config.logging?.level
+                ?? 'info';
+            streamMode = options.streamMode
+                ?? envLogSetting?.streamMode
+                ?? config.logging?.streamMode
+                ?? 'compact';
+        }
+        const logger = createLogger(logLevel, streamMode);
         if (!fsModule.existsSync(configPath)) {
             logger.warn('Veto config not found. Run "npx veto init" to initialize.', {
                 expected: configPath,
@@ -402,8 +449,13 @@ export class Veto {
         });
     }
     static fromRules(options) {
-        const logLevel = options.logLevel ?? 'warn';
-        const logger = createLogger(logLevel);
+        const envLogSetting = Veto.parseEnvLogSetting(typeof process === 'undefined' ? undefined : process.env.VETO_LOG);
+        const logLevel = Veto.resolveExplicitLogLevel(options)
+            ?? envLogSetting?.level
+            ?? Veto.parseEnvLogLevel(typeof process === 'undefined' ? undefined : process.env.VETO_LOG_LEVEL)
+            ?? 'warn';
+        const streamMode = options.streamMode ?? envLogSetting?.streamMode ?? 'compact';
+        const logger = createLogger(logLevel, streamMode);
         const envMode = Veto.parseEnvMode(typeof process === 'undefined' ? undefined : process.env.VETO_MODE);
         const resolvedMode = options.mode ?? envMode;
         const cloudClient = options.cloudClient ?? (options.apiKey
@@ -424,7 +476,7 @@ export class Veto {
                     baseUrl: options.endpoint,
                 }
                 : undefined,
-            logging: { level: logLevel },
+            logging: { level: logLevel, streamMode },
             budget: options.budget,
             costs: options.costs,
             approval: options.approval,
@@ -434,6 +486,7 @@ export class Veto {
         const vetoOptions = {
             mode: resolvedMode,
             logLevel,
+            streamMode,
             sessionId: options.sessionId,
             agentId: options.agentId,
             userId: options.userId,
@@ -443,11 +496,17 @@ export class Veto {
             endpoint: undefined,
             cloudClient,
             onApprovalRequired: options.onApprovalRequired,
+            onDecisionMade: options.onDecisionMade,
         };
         return new Veto(vetoOptions, config, rules, logger, true);
     }
     static async fromCloud(options) {
-        const logger = createLogger('warn');
+        const envLogSetting = Veto.parseEnvLogSetting(typeof process === 'undefined' ? undefined : process.env.VETO_LOG);
+        const logLevel = envLogSetting?.level
+            ?? Veto.parseEnvLogLevel(typeof process === 'undefined' ? undefined : process.env.VETO_LOG_LEVEL)
+            ?? 'warn';
+        const streamMode = envLogSetting?.streamMode ?? 'compact';
+        const logger = createLogger(logLevel, streamMode);
         const cloudClient = new VetoCloudClient({
             config: {
                 apiKey: options.apiKey,
@@ -472,9 +531,29 @@ export class Veto {
         }
         return undefined;
     }
+    static parseEnvLogSetting(value) {
+        if (!value) {
+            return undefined;
+        }
+        const normalized = value.trim().toLowerCase();
+        if (normalized === 'stream') {
+            return { level: 'stream', streamMode: 'compact' };
+        }
+        if (normalized === 'stream:verbose') {
+            return { level: 'stream', streamMode: 'verbose' };
+        }
+        return undefined;
+    }
+    static resolveExplicitLogLevel(options) {
+        if (options.stream) {
+            return 'stream';
+        }
+        return options.logLevel;
+    }
     static parseEnvLogLevel(level) {
         if (level === 'debug'
             || level === 'info'
+            || level === 'stream'
             || level === 'warn'
             || level === 'error'
             || level === 'silent') {
@@ -1149,6 +1228,11 @@ export class Veto {
         if (!ast) {
             try {
                 ast = compile(expression);
+                if (this.compiledExpressionCache.size >= 10_000) {
+                    const firstKey = this.compiledExpressionCache.keys().next().value;
+                    if (firstKey !== undefined)
+                        this.compiledExpressionCache.delete(firstKey);
+                }
                 this.compiledExpressionCache.set(expression, ast);
             }
             catch (error) {
@@ -2026,6 +2110,61 @@ export class Veto {
         };
         this.eventWebhookEmitter.emit(event);
     }
+    notifyDecisionMade(result, toolName) {
+        try {
+            const maybePromise = this.onDecisionMade?.({ ...result, toolName });
+            if (maybePromise && typeof maybePromise.catch === 'function') {
+                maybePromise.catch(() => { });
+            }
+        }
+        catch {
+            // swallow — callback errors must not break guard flow
+        }
+    }
+    /**
+     * Emit a webhook event for economic authorization outcomes.
+     *
+     * Maps economic evaluation results to the appropriate webhook event type:
+     * - budget_exceeded → 'budget_exceeded'
+     * - approval_required → 'approval_triggered'
+     * - budget_warning (>80% utilization on allow) → 'budget_warning'
+     * - spend_committed (successful reservation) → 'spend_committed'
+     */
+    emitEconomicEvent(toolName, args, econResult, economicContext, forceType) {
+        let eventType;
+        if (forceType) {
+            eventType = forceType;
+        }
+        else if (econResult.denial?.reason === 'budget_exceeded') {
+            eventType = 'budget_exceeded';
+        }
+        else if (econResult.denial?.reason === 'approval_required') {
+            eventType = 'approval_triggered';
+        }
+        else {
+            eventType = 'deny';
+        }
+        const event = {
+            eventType,
+            toolName,
+            arguments: args,
+            decision: econResult.decision,
+            reason: econResult.denial?.reason,
+            severity: eventType === 'budget_exceeded' ? 'high' : 'medium',
+            timestamp: new Date().toISOString(),
+            shadow: this.mode === 'shadow' ? true : undefined,
+            economic: {
+                cost: economicContext.cost,
+                currency: economicContext.currency,
+                protocol: economicContext.protocol,
+                payer: economicContext.payer,
+                budget_spent: econResult.denial?.budget_spent,
+                budget_limit: econResult.denial?.budget_limit,
+                budget_remaining: econResult.denial?.budget_remaining,
+            },
+        };
+        this.eventWebhookEmitter.emit(event);
+    }
     toGuardResult(result) {
         const metadata = result.metadata;
         const ruleId = this.extractMetadataString(metadata, ['ruleId', 'rule_id']);
@@ -2376,6 +2515,67 @@ export class Veto {
      * Unlike interceptor execution, this returns raw validation outcomes in log/shadow mode.
      */
     async guard(toolName, args, context = {}) {
+        // Economic pre-checks: payer validation and cost validation run BEFORE
+        // behavioral rules. Budget reservation happens AFTER behavioral rules
+        // to avoid the TOCTOU double-spend (check then reserve race).
+        if (this.economicEvaluator && context.economic) {
+            const econResult = this.economicEvaluator.evaluate(context.economic);
+            if (econResult.decision !== 'allow') {
+                this.logger.warn('Economic authorization denied', {
+                    toolName,
+                    decision: econResult.decision,
+                    reason: econResult.denial?.reason,
+                    cost: context.economic.cost,
+                    protocol: context.economic.protocol,
+                });
+                this.emitEconomicEvent(toolName, args, econResult, context.economic);
+                const result = {
+                    decision: this.mode === 'shadow' ? 'allow' : econResult.decision,
+                    reason: econResult.denial
+                        ? `Economic: ${econResult.denial.reason}`
+                        : 'Economic authorization denied',
+                    economicDenial: econResult.denial,
+                    shadow: this.mode === 'shadow' ? true : undefined,
+                    shadowDecision: this.mode === 'shadow' ? econResult.decision : undefined,
+                };
+                this.notifyDecisionMade(result, toolName);
+                return result;
+            }
+        }
+        // If economic evaluator is configured and can resolve cost from args
+        // (no explicit EconomicContext provided, but cost_extraction is configured)
+        let implicitEconomicContext;
+        if (this.economicEvaluator && !context.economic) {
+            const resolvedCost = this.economicEvaluator.resolveCost(toolName, args);
+            if (resolvedCost !== undefined && resolvedCost > 0) {
+                implicitEconomicContext = {
+                    cost: resolvedCost,
+                    currency: 'USD', // Default currency for implicit extraction
+                    protocol: 'custom',
+                };
+                const econResult = this.economicEvaluator.evaluate(implicitEconomicContext);
+                if (econResult.decision !== 'allow') {
+                    this.logger.warn('Economic authorization denied (implicit cost)', {
+                        toolName,
+                        decision: econResult.decision,
+                        reason: econResult.denial?.reason,
+                        cost: resolvedCost,
+                    });
+                    this.emitEconomicEvent(toolName, args, econResult, implicitEconomicContext);
+                    const result = {
+                        decision: this.mode === 'shadow' ? 'allow' : econResult.decision,
+                        reason: econResult.denial
+                            ? `Economic: ${econResult.denial.reason}`
+                            : 'Economic authorization denied',
+                        economicDenial: econResult.denial,
+                        shadow: this.mode === 'shadow' ? true : undefined,
+                        shadowDecision: this.mode === 'shadow' ? econResult.decision : undefined,
+                    };
+                    this.notifyDecisionMade(result, toolName);
+                    return result;
+                }
+            }
+        }
         const customContext = {
             ...(context.custom ?? {}),
         };
@@ -2415,7 +2615,34 @@ export class Veto {
         this.historyTracker.record(toolName, args, validationResult, aggregatedResult.totalDurationMs);
         this.emitDecisionEvent(validationContext, validationResult);
         this.logClientDecision(validationContext, validationResult, aggregatedResult.totalDurationMs);
-        return this.toGuardResult(validationResult);
+        // If behavioral rules allow and economic context exists, reserve budget.
+        // Skip reservation in shadow mode — shadow should never deduct real budget.
+        const behavioralResult = this.toGuardResult(validationResult);
+        const effectiveEconomic = context.economic ?? implicitEconomicContext;
+        if (behavioralResult.decision === 'allow'
+            && this.economicEvaluator
+            && effectiveEconomic
+            && effectiveEconomic.cost > 0
+            && this.mode !== 'shadow') {
+            const reserveResult = this.economicEvaluator.reserveBudget(effectiveEconomic.cost, effectiveEconomic.currency);
+            if (reserveResult.decision !== 'allow') {
+                this.emitEconomicEvent(toolName, args, reserveResult, effectiveEconomic);
+                const result = {
+                    ...behavioralResult,
+                    decision: reserveResult.decision,
+                    reason: reserveResult.denial
+                        ? `Economic: ${reserveResult.denial.reason}`
+                        : 'Budget reservation failed',
+                    economicDenial: reserveResult.denial,
+                };
+                this.notifyDecisionMade(result, toolName);
+                return result;
+            }
+            // Emit spend_committed event on successful reservation
+            this.emitEconomicEvent(toolName, args, reserveResult, effectiveEconomic, 'spend_committed');
+        }
+        this.notifyDecisionMade(behavioralResult, toolName);
+        return behavioralResult;
     }
     /**
      * Cache an approval preference for a tool.
@@ -2512,6 +2739,9 @@ export class Veto {
                 });
             });
         }, refreshIntervalMs);
+        if (typeof this.refreshIntervalId === 'object' && this.refreshIntervalId !== null && 'unref' in this.refreshIntervalId) {
+            this.refreshIntervalId.unref();
+        }
     }
     /**
      * Get history statistics.
@@ -2537,6 +2767,19 @@ export class Veto {
     resetBudget() {
         this.budgetTracker?.reset();
     }
+    /**
+     * Get current economic budget status for a scope.
+     * Returns null if no economic policy is configured.
+     */
+    getEconomicBudgetStatus(scope = 'session') {
+        return this.economicBudgetEngine?.getStatus(scope) ?? null;
+    }
+    /**
+     * Reset economic budget for a scope.
+     */
+    resetEconomicBudget(scope = 'session') {
+        this.economicBudgetEngine?.reset(scope);
+    }
     dispose() {
         if (this.refreshIntervalId) {
             clearInterval(this.refreshIntervalId);