TypeScript SDK in 5 minutes

The TypeScript version of the five-minute setup: one npm package, the same five environment values as Python, one init() — and your Node agent's actions start arriving on the tape, signed and sealed. Byte-for-byte the same wire format as the Python SDK, so a mixed-language fleet records one consistent trail.

1 · Install

1npm install @wytness/ai

Microsoft's Agent Governance SDK comes along as a dependency — identity and hash-chaining included, no second integration to plan. The package ships both ESM and CommonJS builds, so it drops into whichever module setup your service already uses.

2 · Keys and environment

Same ceremony as ever: API key and signing key from the Keys page (private halves stay with you), plus the sealing pair if you're using PII pseudonymisation. The SDK reads the same WYTNESS_* environment variables as its Python sibling, so your secrets-manager setup is written once for both languages — five values, one place, every service. And the same strictness applies: no signing key, no start. An unsigned event is a claim, not evidence, and neither SDK will produce one.

3 · Wire it in

1import { init, shutdown, AuditLogger } from "@wytness/ai";
2 
3// piiFields lists the dotted paths to pseudonymise before egress.
4await init({ piiFields: ["customer.email", "customer.name"] });
5 
6// Use AGT exactly as you would without the wrapper.
7const audit = new AuditLogger();
8 
9audit.log({
10  agentId: "billing-agent",
11  action: "tool_invocation:send_invoice",
12  decision: "allow",
13});
14 
15// Drain the in-flight batch on exit.
16await shutdown();

Auto-wire is on by default: init() hooks AGT's audit logger, so entries your agent was already writing flow into signing and pseudonymisation without further changes — and it wraps the LLM clients too, so your OpenAI and Anthropic calls are recorded automatically, token counts and streams included. Prefer to attach the sink yourself? autoWire: false and the API reference cover the manual path — everything the automatic wiring does is also a plain function you can call.

4 · Verify the arrival

Run the agent, open Events, find your row. The sealed fields show tokens; the verification mark confirms the envelope checked out against your registered public key.

If you also run Python agents, notice what you don't see: any difference. Both SDKs produce the same canonical event shape — not merely similar, but verified byte-for-byte compatible on the wire — so audits, exports, and verification never care which language acted. That parity is a deliberate contract, pinned by cross-SDK tests on our side, and it's what makes a mixed fleet's trail read as one system rather than two stapled together. Your auditor samples events, not languages.

The same three properties

As with the Python setup: every action signed with a key only you hold, declared PII sealed before egress, and a trail outsiders can verify. And the same list of things you didn't have to build — no log shipping, no correlation pipeline, no retention jobs. Five minutes per language, one trail for the fleet. The full walk-through lives in the TypeScript quickstart. Questions? Ask us.