Skip to content

v0.9.0 — Full LLM lifecycle coverage across featured adapters

Choose a tag to compare

View all tags
@scotty595 scotty595 released this 14 Apr 22:29
· 22 commits to main since this release
v0.9.0
5bb2920

Highlights

Full pre/post/streaming coverage across all 10 featured framework adapters. Every featured adapter now supports input pre-scan, output post-scan, streaming post-scan (buffered / sliding / per-chunk), and tool-call enforcement.

What's new

Featured adapters — full lifecycle

  • Vercel AI SDK — createGovernanceMiddleware now returns transformParams (pre), wrapGenerate (post), wrapStream (streaming post). Config accepts streamMode, streamLookbackChunks, streamLookbackChars.
  • Anthropic SDK — createGovernedMessages, createGovernedMessageStream
  • LangChain — wrapChatModel overrides .invoke() and .stream() with governance pre/post enforcement
  • OpenAI Agents SDK — createInputGuardrail, createOutputGuardrail produce SDK-native guardrail objects
  • Mastra Processor — implements processOutputStream with per-chunk / sliding / buffered modes
  • Mastra middleware — exposes scanInput, scanOutput, scanOutputStream helpers
  • Genkit — createGovernedGenerate, createGovernedGenerateStream
  • LlamaIndex — wrapLlamaLLM wraps any LLM implementing chat({ messages, stream? })
  • Mistral — createGovernedChat, createGovernedChatStream
  • Ollama — createGovernedOllamaChat, createGovernedOllamaChatStream

Specialty adapters

  • MCP — added symmetric input injection scan on tool-call arguments (scanToolInputs, inputInjectionThreshold) to match existing output scan
  • Bedrock — entry-gate pre-scan on invokeAgent input + scanOutput helper for post-scan

Shared core

  • New src/plugins/pre-post-enforce.ts and src/plugins/pre-post-stream.ts — shared pre/post + streaming helpers power every featured adapter.

Breaking changes

Drop Node 18 support

engines.node bumped from >=18 to >=20. Node 18 reached end-of-life in April 2025, and several existing tests (Ed25519 agent identity, audit-integrity HMAC chain, agent-identity tokens) require crypto primitives that aren't reliable on Node 18. CI matrix is now [20, 22, 24].

Pruned 8 adapter stubs

Removed plugins/crewai, plugins/autogen, plugins/semantic-kernel, plugins/a2a, plugins/e2b, plugins/deno, plugins/cloudflare-ai, plugins/composio — they didn't meaningfully govern anything. Python support is via the Lua Governance REST API.

Docs

READMEs refactored to a single Featured tier (10 adapters) and a Specialty tier (MCP, Bedrock) with honest scope framing.

Install

```bash
npm install governance-sdk
```

Zero runtime dependencies. 1,291 tests. MIT licensed.

Full changelog: https://github.com/lua-ai-global/governance/blob/main/packages/governance/CHANGELOG.md

Assets 2
Loading