{"_id":"@agent-governance-sdk/sdk","name":"@agent-governance-sdk/sdk","dist-tags":{"latest":"0.1.0"},"versions":{"0.1.0":{"name":"@agent-governance-sdk/sdk","version":"0.1.0","description":"Production-grade audit logging, human oversight gates, and EU AI Act compliance reporting for AI agent deployments.","type":"module","main":"src/index.js","exports":{".":"./src/index.js","./adapters/postgres":"./src/adapters/postgres.js","./adapters/memory":"./src/adapters/memory.js","./adapters/langchain":"./src/adapters/langchain.js","./adapters/langgraph":"./src/adapters/langgraph.js","./adapters/autogen":"./src/adapters/autogen.js","./adapters/crewai":"./src/adapters/crewai.js"},"keywords":["ai-governance","eu-ai-act","agent-audit","human-oversight","compliance","langchain","anthropic","openai","audit-log"],"author":{"name":"Agent Governance Contributors"},"license":"MIT","repository":{"type":"git","url":"git+https://github.com/agent-governance-sdk/sdk.git"},"homepage":"https://github.com/agent-governance-sdk/sdk#readme","bugs":{"url":"https://github.com/agent-governance-sdk/sdk/issues"},"publishConfig":{"access":"public"},"dependencies":{},"devDependencies":{"vitest":"^3.0.0"},"scripts":{"test":"vitest run","test:watch":"vitest"},"engines":{"node":">=18.0.0"},"gitHead":"275c4b75d0b9096795f2a1a0cf695051e81221b2","_id":"@agent-governance-sdk/sdk@0.1.0","_nodeVersion":"25.4.0","_npmVersion":"11.7.0","dist":{"integrity":"sha512-+sa+Bz083+yMGKzW+z3f0CwjGRtNoQNYPrJXi7wzUmWkt5O8GN/XtP5JDMmIoE/3w3snMd7gnGs0E8fOgSF4ng==","shasum":"a0a552e79e89eeb5cb9428fd9cace1562c07a5e2","tarball":"https://registry.npmjs.org/@agent-governance-sdk/sdk/-/sdk-0.1.0.tgz","fileCount":17,"unpackedSize":46167,"signatures":[{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEYCIQC5qUmlMTmqaz/ZSXWCGDDLIiCZqaK/2Y+RR4x7rQ1MrgIhAOoC2G7Qeo88aEUNwZbCT/pDhIQzv0PYOxUWceZhgk0L"}]},"_npmUser":{"name":"agent-governance-sdk","email":"hello@agent-governance.dev"},"directories":{},"maintainers":[{"name":"agent-governance-sdk","email":"hello@agent-governance.dev"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/sdk_0.1.0_1773650853547_0.763695280252213"},"_hasShrinkwrap":false}},"time":{"created":"2026-03-16T08:47:33.432Z","0.1.0":"2026-03-16T08:47:33.681Z","modified":"2026-03-16T08:47:33.933Z"},"maintainers":[{"name":"agent-governance-sdk","email":"hello@agent-governance.dev"}],"description":"Production-grade audit logging, human oversight gates, and EU AI Act compliance reporting for AI agent deployments.","homepage":"https://github.com/agent-governance-sdk/sdk#readme","keywords":["ai-governance","eu-ai-act","agent-audit","human-oversight","compliance","langchain","anthropic","openai","audit-log"],"repository":{"type":"git","url":"git+https://github.com/agent-governance-sdk/sdk.git"},"author":{"name":"Agent Governance Contributors"},"bugs":{"url":"https://github.com/agent-governance-sdk/sdk/issues"},"license":"MIT","readme":"# @agent-governance-sdk/sdk\n\nProduction-grade audit logging, human oversight gates, and EU AI Act\ncompliance reporting for AI agent deployments.\n\n**The EU AI Act requires governance infrastructure for AI agents by\nAugust 2026.** This SDK provides the three primitives you need in\nunder 30 minutes: an immutable audit log, a human oversight gate,\nand an Article 13 compliance report generator.\n\n**Production proof:** [app.getaptum.app/audit](https://app.getaptum.app/audit)\n— a live deployment using this exact pattern, processing real\ngovernment procurement data.\n\n## Install\n\n```bash\nnpm install @agent-governance-sdk/sdk\n```\n\n## Quickstart\n\n```javascript\nimport { createGovernance, MemoryAdapter, HumanCheckpointError } from '@agent-governance-sdk/sdk';\n\nconst adapter = new MemoryAdapter();\nconst { auditLog, checkpoint, compliance } = createGovernance(adapter, {\n  ownerId: 'user-123',\n});\n\n// 1. Wrap any agent action in an audit log entry\nconst result = await auditLog.wrap({\n  agent: 'scoring',\n  eventType: 'score_complete',\n  model: 'claude-sonnet-4-6',\n  input: { text: 'Analyze this document' },\n  resourceId: 'doc-001',\n  action: async () => ({ score: 87 }),\n});\n\n// 2. Gate consequential actions on human approval\ntry {\n  await checkpoint.require({ resourceId: 'doc-001', requiredDecision: 'approve' });\n} catch (err) {\n  // HumanCheckpointError — no human has approved yet\n}\n\n// 3. Record human decision, then proceed\nawait checkpoint.record({ resourceId: 'doc-001', decision: 'approve', rationale: 'Looks good' });\nawait checkpoint.require({ resourceId: 'doc-001', requiredDecision: 'approve' }); // passes\n\n// 4. Generate an EU AI Act Article 13 compliance report\nconst report = await compliance.generate({ ownerId: 'user-123' });\n```\n\n## The Three Primitives\n\n### AuditLog.wrap()\n\n```javascript\nconst result = await auditLog.wrap({\n  agent: 'scoring',\n  eventType: 'score_complete',\n  model: 'claude-sonnet-4-6',\n  input: { rfpText, kbEntries },      // hashed, never stored\n  resourceId: rfpId,\n  metadata: { version: '2.1' },\n  action: () => scoringAgent.run(rfpText, kbEntries),\n});\n// Automatically records: timestamp, duration, token counts,\n// input/output SHA256 hashes, errors. Fire-and-forget —\n// audit failures never break your pipeline.\n```\n\n### HumanCheckpoint.require()\n\n```javascript\nawait checkpoint.require({\n  resourceId: rfpId,\n  requiredDecision: 'bid',\n  errorMessage: 'A human must approve before drafting.',\n});\n// Throws HumanCheckpointError if no matching decision exists.\n// Enforces human oversight at the code level — not just the UI.\n```\n\n### ComplianceReport.generate()\n\n```javascript\nconst report = await compliance.generate({ ownerId: 'user-123' });\n// Returns structured JSON: provider info, system description,\n// human oversight measures, performance metrics, token costs,\n// tamper evidence, known limitations, attestation fields.\n\nconst markdown = await compliance.toMarkdown({ ownerId: 'user-123' });\n// Formatted for regulatory filings.\n```\n\n## Production Setup (Supabase / PostgreSQL)\n\nApply the migration — the same tables used in production at getaptum.app:\n\n```sql\n-- sql/schema.sql (included in this package)\ncreate table agent_audit_log (\n  id             uuid primary key default gen_random_uuid(),\n  ts             timestamptz not null default now(),\n  event_type     text not null,\n  agent          text not null,\n  model          text,\n  resource_id    text,\n  owner_id       text,\n  input_hash     text,\n  output_hash    text,\n  input_tokens   integer,\n  output_tokens  integer,\n  duration_ms    integer,\n  metadata       jsonb,\n  error          text\n);\n\nalter table agent_audit_log enable row level security;\nalter table agent_audit_log force row level security;\n-- No UPDATE or DELETE policies — immutable by design\n```\n\n```javascript\nimport { createGovernance, PostgresAdapter } from '@agent-governance-sdk/sdk';\nimport { createClient } from '@supabase/supabase-js';\n\nconst supabase = createClient(url, serviceRoleKey);\nconst adapter = new PostgresAdapter({ client: supabase });\n\nconst { auditLog, checkpoint, compliance } = createGovernance(adapter, {\n  ownerId: user.id,\n});\n```\n\nOr with a raw `pg` Pool:\n\n```javascript\nimport { Pool } from 'pg';\nconst pool = new Pool({ connectionString: process.env.DATABASE_URL });\nconst adapter = new PostgresAdapter({ pool });\n```\n\n## Framework Integrations\n\n### LangChain\n\n```javascript\nimport { withGovernance } from '@agent-governance-sdk/sdk/adapters/langchain';\nimport { ChatAnthropic } from '@langchain/anthropic';\n\nconst model = new ChatAnthropic({ model: 'claude-sonnet-4-6' });\nconst governed = withGovernance(model, auditLog, { agent: 'scoring', resourceId });\nconst response = await governed.invoke(messages);\n```\n\n### LangGraph\n\n```javascript\nimport { governedNode } from '@agent-governance-sdk/sdk/adapters/langgraph';\n\nconst scoringNode = governedNode(auditLog, { agent: 'scoring', model: 'claude-sonnet-4-6' },\n  async (state) => {\n    const result = await model.invoke(state.messages);\n    return { messages: [result] };\n  }\n);\nconst graph = new StateGraph({ channels }).addNode('scoring', scoringNode).compile();\n```\n\n### AutoGen\n\n```javascript\nimport { withGovernance } from '@agent-governance-sdk/sdk/adapters/autogen';\n\nconst agent = new AssistantAgent({ name: 'scoring', llm_config });\nconst governed = withGovernance(agent, auditLog, { agent: 'scoring' });\n```\n\n### CrewAI\n\n```javascript\nimport { withGovernance } from '@agent-governance-sdk/sdk/adapters/crewai';\n\nconst crew = new Crew({ agents, tasks });\nconst governed = withGovernance(crew, auditLog, { agent: 'crewai' });\nconst result = await governed.kickoff();\n```\n\n## EU AI Act Reference\n\n| SDK Feature | EU AI Act Article |\n|---|---|\n| AuditLog (immutable) | Article 12 — Record keeping |\n| HumanCheckpoint | Article 14 — Human oversight |\n| ComplianceReport | Article 13 — Transparency |\n| Input/output hashing | Article 12(1) — Logging sufficient to assess performance |\n\n## Architecture\n\nThis SDK was extracted from the governance layer of [Aptum](https://getaptum.app), a production proposal intelligence platform for government contractors. The human decision gate has processed real bid/no-bid decisions on US federal and Mexico federal procurement opportunities — no draft proposal can be generated without an authenticated human decision recorded at the database layer. The `agent_audit_log` has been append-only and tamper-evident since March 2026. This is not a reference implementation — it is a production pattern.\n\nZero runtime dependencies. The library uses your application's existing database client (Supabase, pg, or any adapter you implement). Governance infrastructure should not add dependency surface area to the applications it governs.\n\n## Roadmap\n\n**v0.1 (current):** Core primitives, PostgreSQL/SQLite/memory adapters,\nframework helpers, Article 13 report generator.\n\n**v0.2:** Cloud-hosted compliance dashboard, webhook support for\nhuman checkpoint notifications (Slack, email, PagerDuty),\nconfidence score logging.\n\n**v1.0:** Formal EU AI Act Article mapping certification,\nNIST AI RMF alignment documentation, enterprise support.\n\n## Contributing\n\nSee [CONTRIBUTING.md](CONTRIBUTING.md).\n\n## License\n\nMIT — see [LICENSE](LICENSE).\n","readmeFilename":"README.md","_rev":"1-9a1ef57d1c3401debe1302a5088b7796"}