Prove who approved what.
When AI agents act for your customers,
decide what they may seedownloadchangesend.

// npm i onehumanai: one package with the engine inside. Import only from 'onehumanai'
import { onehuman } from 'onehumanai';

const oh = await onehuman({
  secret: process.env.ONEHUMAN_SECRET,            // 32+ bytes, keep it stable: it signs tokens and decision proofs
  policy: './onehuman.policy.json',
  db: 'sqlite:./onehuman.db',
  identify: (req) => req.session?.userId ?? null,   // your login id, never a constant
  apiKey: process.env.ONEHUMAN_API_KEY,           // optional: the portal shows agent share, decisions, proofs
});
app.use(oh.middleware());                    // serves /onehuman/sdk.js, /health, /proof-keys and the SDK's API
app.get('/api/balance', oh.protect('balance.read'), (req, res) => oh.send(req, res, balance, maskBalance));

<script src="/onehuman/sdk.js"></script>

// call protected endpoints through the SDK; it sends the evidence and keeps one visitor one session
const r = await OneHuman.fetch('/api/balance');

// mark rendered sensitive values; they are redacted the instant an agent attaches
<div data-oh-sensitive="full">$4,939.10</div>

// after deploying: four checks, then the auditor's own check of a proof
npx onehumanai verify https://your-app.example /api/balance
npx onehumanai verify-proof proofs.json --keys https://your-app.example/onehuman/proof-keys

{
  "version": "bank-policy-1",
  "enforcement": "observe",
  "rules": [
    { "resource": "balance.read",  "onAgent": "mask",  "onArtifact": "mask",    "onUnknown": "allow",   "onHumanLike": "allow" },
    { "resource": "report.export", "onAgent": "block", "onArtifact": "step_up", "onUnknown": "step_up", "onHumanLike": "allow" }
  ]
}

https://www.npmjs.com/package/onehumanai: install this into my project.
Follow the README protocol: `npm i onehumanai` (one package; its engine dependency comes with it),
scan the app, show me what an AI browser agent could reach and how to gate it, ask me the nine
decisions, implement server + page + policy + masks, verify with `npx onehumanai verify`, then report.
Licence: the package is Apache-2.0; the engine is BUSL-1.1 with production use granted. Say so if asked.