@asterpay/attest-sdk 0.1.0

package/dist/ai-packages.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Known AI / LLM SDK package names (npm import specifiers, without version).
+ * Extend as ecosystem evolves.
+ */
+export declare const AI_SDK_PACKAGES: readonly string[];
+/** Patterns in source text that suggest prohibited / high-risk use cases (heuristic). */
+export declare const HIGH_RISK_KEYWORDS: readonly ["credit score", "credit scoring", "loan approval", "recruitment", "hiring decision", "biometric", "facial recognition", "emotion recognition", "social scoring", "manipulation", "subliminal"];
+export declare const PROHIBITED_KEYWORDS: readonly ["social scoring", "subliminal", "manipulative techniques", "real-time remote biometric"];
+//# sourceMappingURL=ai-packages.d.ts.map

package/dist/ai-packages.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai-packages.d.ts","sourceRoot":"","sources":["../src/ai-packages.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,SAAS,MAAM,EAoC5C,CAAC;AAEF,yFAAyF;AACzF,eAAO,MAAM,kBAAkB,0MAYrB,CAAC;AAEX,eAAO,MAAM,mBAAmB,oGAKtB,CAAC"}

package/dist/ai-packages.js

@@ -0,0 +1,62 @@
+/**
+ * Known AI / LLM SDK package names (npm import specifiers, without version).
+ * Extend as ecosystem evolves.
+ */
+export const AI_SDK_PACKAGES = [
+    'openai',
+    '@anthropic-ai/sdk',
+    '@google/generative-ai',
+    '@google-cloud/aiplatform',
+    '@google-cloud/vertexai',
+    '@azure/openai',
+    '@aws-sdk/client-bedrock-runtime',
+    'cohere-ai',
+    '@mistralai/mistralai',
+    'replicate',
+    '@huggingface/inference',
+    'langchain',
+    '@langchain/core',
+    '@langchain/openai',
+    'ai',
+    '@ai-sdk/openai',
+    '@ai-sdk/anthropic',
+    '@ai-sdk/google',
+    'groq-sdk',
+    '@xenova/transformers',
+    'ollama',
+    'together-ai',
+    '@deepgram/sdk',
+    'assemblyai',
+    'elevenlabs',
+    'anthropic',
+    'vertexai',
+    'openai-edge',
+    '@openai/agents',
+    'voyageai',
+    'pinecone-client',
+    '@pinecone-database/pinecone',
+    'weaviate-ts-client',
+    'chromadb',
+    '@qdrant/js-client-rest',
+];
+/** Patterns in source text that suggest prohibited / high-risk use cases (heuristic). */
+export const HIGH_RISK_KEYWORDS = [
+    'credit score',
+    'credit scoring',
+    'loan approval',
+    'recruitment',
+    'hiring decision',
+    'biometric',
+    'facial recognition',
+    'emotion recognition',
+    'social scoring',
+    'manipulation',
+    'subliminal',
+];
+export const PROHIBITED_KEYWORDS = [
+    'social scoring',
+    'subliminal',
+    'manipulative techniques',
+    'real-time remote biometric',
+];
+//# sourceMappingURL=ai-packages.js.map

package/dist/ai-packages.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai-packages.js","sourceRoot":"","sources":["../src/ai-packages.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAsB;IAChD,QAAQ;IACR,mBAAmB;IACnB,uBAAuB;IACvB,0BAA0B;IAC1B,wBAAwB;IACxB,eAAe;IACf,iCAAiC;IACjC,WAAW;IACX,sBAAsB;IACtB,WAAW;IACX,wBAAwB;IACxB,WAAW;IACX,iBAAiB;IACjB,mBAAmB;IACnB,IAAI;IACJ,gBAAgB;IAChB,mBAAmB;IACnB,gBAAgB;IAChB,UAAU;IACV,sBAAsB;IACtB,QAAQ;IACR,aAAa;IACb,eAAe;IACf,YAAY;IACZ,YAAY;IACZ,WAAW;IACX,UAAU;IACV,aAAa;IACb,gBAAgB;IAChB,UAAU;IACV,iBAAiB;IACjB,6BAA6B;IAC7B,oBAAoB;IACpB,UAAU;IACV,wBAAwB;CACzB,CAAC;AAEF,yFAAyF;AACzF,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,cAAc;IACd,gBAAgB;IAChB,eAAe;IACf,aAAa;IACb,iBAAiB;IACjB,WAAW;IACX,oBAAoB;IACpB,qBAAqB;IACrB,gBAAgB;IAChB,cAAc;IACd,YAAY;CACJ,CAAC;AAEX,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,gBAAgB;IAChB,YAAY;IACZ,yBAAyB;IACzB,4BAA4B;CACpB,CAAC"}

package/dist/attest.d.ts

@@ -0,0 +1,28 @@
+import { type DisclosureLocale } from './transparency.js';
+import type { AttestConfig, ComplianceReport, ExportAuditOptions, GenerateDocsOptions, RiskClassification, ScanResult, TrackMeta } from './types.js';
+export declare class Attest {
+    private readonly config;
+    private readonly projectRoot;
+    private readonly audit?;
+    constructor(config: AttestConfig);
+    scan(): ScanResult;
+    classifyRisk(): Promise<RiskClassification>;
+    check(): ComplianceReport;
+    generateDocs(options: GenerateDocsOptions): Promise<{
+        files: string[];
+    }>;
+    exportAuditLog(options: ExportAuditOptions): string;
+    disclosure(locale?: DisclosureLocale, opts?: {
+        humanAvailable?: boolean;
+    }): string;
+    /**
+     * Wrap an async AI call with audit logging (duration, optional meta).
+     */
+    track<T>(fn: () => Promise<T>, meta?: TrackMeta): Promise<T>;
+    verifyAuditChain(): {
+        ok: boolean;
+        brokenAt?: number;
+    };
+}
+export declare function defaultAuditPath(projectRoot: string): string;
+//# sourceMappingURL=attest.d.ts.map

package/dist/attest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"attest.d.ts","sourceRoot":"","sources":["../src/attest.ts"],"names":[],"mappings":"AAMA,OAAO,EAAiB,KAAK,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACzE,OAAO,KAAK,EACV,YAAY,EACZ,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,UAAU,EACV,SAAS,EACV,MAAM,YAAY,CAAC;AAEpB,qBAAa,MAAM;IACjB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAe;IACtC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAc;gBAEzB,MAAM,EAAE,YAAY;IAUhC,IAAI,IAAI,UAAU;IAIZ,YAAY,IAAI,OAAO,CAAC,kBAAkB,CAAC;IAKjD,KAAK,IAAI,gBAAgB;IAKnB,YAAY,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAY9E,cAAc,CAAC,OAAO,EAAE,kBAAkB,GAAG,MAAM;IASnD,UAAU,CAAC,MAAM,GAAE,gBAAuB,EAAE,IAAI,CAAC,EAAE;QAAE,cAAc,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,MAAM;IAIxF;;OAEG;IACG,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,CAAC,CAAC;IA6BlE,gBAAgB,IAAI;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE;CAGvD;AAED,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAE5D"}

package/dist/attest.js

@@ -0,0 +1,92 @@
+import * as path from 'node:path';
+import { AuditLogger } from './audit-logger.js';
+import { checkCompliance } from './compliance-checker.js';
+import { classifyRisk } from './risk-classifier.js';
+import { generateAnnexIvDocs } from './docs-generator.js';
+import { scanProject } from './scanner.js';
+import { getDisclosure } from './transparency.js';
+export class Attest {
+    config;
+    projectRoot;
+    audit;
+    constructor(config) {
+        this.config = config;
+        this.projectRoot = path.resolve(config.projectRoot ?? process.cwd());
+        const logPath = config.auditLogPath ?? path.join(this.projectRoot, '.attest', 'audit.jsonl');
+        this.audit = new AuditLogger(logPath, config.system.name);
+    }
+    scan() {
+        return scanProject({ rootDir: this.projectRoot });
+    }
+    async classifyRisk() {
+        const scan = this.scan();
+        return classifyRisk(scan);
+    }
+    check() {
+        const scan = this.scan();
+        return checkCompliance(scan, this.projectRoot);
+    }
+    async generateDocs(options) {
+        const scan = this.scan();
+        const risk = classifyRisk(scan);
+        return generateAnnexIvDocs(scan, risk, {
+            outputDir: options.outputDir,
+            systemName: this.config.system.name,
+            provider: this.config.system.provider,
+            description: this.config.system.description,
+            language: options.language,
+        });
+    }
+    exportAuditLog(options) {
+        if (!this.audit)
+            return '';
+        const entries = this.audit.exportJson(options.from);
+        if (options.format === 'jsonl') {
+            return entries.map((e) => JSON.stringify(e)).join('\n') + '\n';
+        }
+        return JSON.stringify(entries, null, 2) + '\n';
+    }
+    disclosure(locale = 'en', opts) {
+        return getDisclosure(locale, opts);
+    }
+    /**
+     * Wrap an async AI call with audit logging (duration, optional meta).
+     */
+    async track(fn, meta) {
+        if (!this.audit)
+            return fn();
+        const start = Date.now();
+        try {
+            const result = await fn();
+            const ms = Date.now() - start;
+            this.audit.append({
+                action: 'ai_inference',
+                model: meta?.model,
+                purpose: meta?.purpose,
+                input_type: 'text',
+                contains_pii: meta?.containsPII ?? false,
+                human_oversight: meta?.humanOversight ?? 'none',
+                response_time_ms: ms,
+            });
+            return result;
+        }
+        catch (err) {
+            const ms = Date.now() - start;
+            this.audit.append({
+                action: 'ai_inference_error',
+                model: meta?.model,
+                purpose: meta?.purpose,
+                response_time_ms: ms,
+                error: err instanceof Error ? err.message : String(err),
+            });
+            throw err;
+        }
+    }
+    verifyAuditChain() {
+        return this.audit?.verifyChain() ?? { ok: true };
+    }
+}
+export function defaultAuditPath(projectRoot) {
+    return path.join(projectRoot, '.attest', 'audit.jsonl');
+}
+//# sourceMappingURL=attest.js.map

package/dist/attest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attest.js","sourceRoot":"","sources":["../src/attest.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAyB,MAAM,mBAAmB,CAAC;AAWzE,MAAM,OAAO,MAAM;IACA,MAAM,CAAe;IACrB,WAAW,CAAS;IACpB,KAAK,CAAe;IAErC,YAAY,MAAoB;QAC9B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,OAAO,CAC7B,MAAM,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,CACpC,CAAC;QACF,MAAM,OAAO,GACX,MAAM,CAAC,YAAY,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;QAC/E,IAAI,CAAC,KAAK,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC5D,CAAC;IAED,IAAI;QACF,OAAO,WAAW,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACzB,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAED,KAAK;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACzB,OAAO,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IACjD,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,OAA4B;QAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAChC,OAAO,mBAAmB,CAAC,IAAI,EAAE,IAAI,EAAE;YACrC,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI;YACnC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ;YACrC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW;YAC3C,QAAQ,EAAE,OAAO,CAAC,QAAQ;SAC3B,CAAC,CAAC;IACL,CAAC;IAED,cAAc,CAAC,OAA2B;QACxC,IAAI,CAAC,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACpD,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YAC/B,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;QACjE,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC;IACjD,CAAC;IAED,UAAU,CAAC,SAA2B,IAAI,EAAE,IAAmC;QAC7E,OAAO,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACrC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,KAAK,CAAI,EAAoB,EAAE,IAAgB;QACnD,IAAI,CAAC,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,EAAE,EAAE,CAAC;YAC1B,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;YAC9B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;gBAChB,MAAM,EAAE,cAAc;gBACtB,KAAK,EAAE,IAAI,EAAE,KAAK;gBAClB,OAAO,EAAE,IAAI,EAAE,OAAO;gBACtB,UAAU,EAAE,MAAM;gBAClB,YAAY,EAAE,IAAI,EAAE,WAAW,IAAI,KAAK;gBACxC,eAAe,EAAE,IAAI,EAAE,cAAc,IAAI,MAAM;gBAC/C,gBAAgB,EAAE,EAAE;aACrB,CAAC,CAAC;YACH,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;YAC9B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;gBAChB,MAAM,EAAE,oBAAoB;gBAC5B,KAAK,EAAE,IAAI,EAAE,KAAK;gBAClB,OAAO,EAAE,IAAI,EAAE,OAAO;gBACtB,gBAAgB,EAAE,EAAE;gBACpB,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACxD,CAAC,CAAC;YACH,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,gBAAgB;QACd,OAAO,IAAI,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACnD,CAAC;CACF;AAED,MAAM,UAAU,gBAAgB,CAAC,WAAmB;IAClD,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;AAC1D,CAAC"}

package/dist/audit-logger.d.ts

@@ -0,0 +1,34 @@
+export interface AuditEntry {
+    id: string;
+    timestamp: string;
+    system: string;
+    action: string;
+    model?: string;
+    purpose?: string;
+    input_type?: string;
+    contains_pii?: boolean;
+    human_oversight?: string;
+    response_time_ms?: number;
+    tokens_used?: number;
+    error?: string;
+    hash: string;
+    previous_hash: string | null;
+}
+export declare class AuditLogger {
+    private readonly logPath;
+    private readonly systemName;
+    private lastHash;
+    constructor(logPath: string, systemName: string);
+    private loadLastHash;
+    /** `system` is always taken from the logger instance — do not pass it in `partial`. */
+    append(partial: Omit<AuditEntry, 'id' | 'timestamp' | 'hash' | 'previous_hash' | 'system'> & {
+        action: string;
+    }): AuditEntry;
+    readAll(): AuditEntry[];
+    exportJson(fromIso?: string): AuditEntry[];
+    verifyChain(): {
+        ok: boolean;
+        brokenAt?: number;
+    };
+}
+//# sourceMappingURL=audit-logger.d.ts.map

package/dist/audit-logger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-logger.d.ts","sourceRoot":"","sources":["../src/audit-logger.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAwBD,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAuB;gBAE3B,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM;IAM/C,OAAO,CAAC,YAAY;IAkBpB,uFAAuF;IACvF,MAAM,CACJ,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,GAAG,WAAW,GAAG,MAAM,GAAG,eAAe,GAAG,QAAQ,CAAC,GAAG;QACpF,MAAM,EAAE,MAAM,CAAC;KAChB,GACA,UAAU;IAmBb,OAAO,IAAI,UAAU,EAAE;IAUvB,UAAU,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,UAAU,EAAE;IAO1C,WAAW,IAAI;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE;CA4BlD"}

package/dist/audit-logger.js

@@ -0,0 +1,116 @@
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { createHash, randomUUID } from 'node:crypto';
+function sha256Hex(input) {
+    return createHash('sha256').update(input, 'utf8').digest('hex');
+}
+function serializeForHash(entry) {
+    return JSON.stringify({
+        id: entry.id,
+        timestamp: entry.timestamp,
+        system: entry.system,
+        action: entry.action,
+        model: entry.model,
+        purpose: entry.purpose,
+        input_type: entry.input_type,
+        contains_pii: entry.contains_pii,
+        human_oversight: entry.human_oversight,
+        response_time_ms: entry.response_time_ms,
+        tokens_used: entry.tokens_used,
+        error: entry.error,
+        previous_hash: entry.previous_hash,
+    });
+}
+export class AuditLogger {
+    logPath;
+    systemName;
+    lastHash = null;
+    constructor(logPath, systemName) {
+        this.logPath = path.resolve(logPath);
+        this.systemName = systemName;
+        this.loadLastHash();
+    }
+    loadLastHash() {
+        if (!fs.existsSync(this.logPath)) {
+            this.lastHash = null;
+            return;
+        }
+        const lines = fs.readFileSync(this.logPath, 'utf8').trim().split('\n').filter(Boolean);
+        if (lines.length === 0) {
+            this.lastHash = null;
+            return;
+        }
+        try {
+            const last = JSON.parse(lines[lines.length - 1]);
+            this.lastHash = last.hash;
+        }
+        catch {
+            this.lastHash = null;
+        }
+    }
+    /** `system` is always taken from the logger instance — do not pass it in `partial`. */
+    append(partial) {
+        const id = `log_${randomUUID()}`;
+        const timestamp = new Date().toISOString();
+        const previous_hash = this.lastHash;
+        const base = {
+            ...partial,
+            id,
+            timestamp,
+            system: this.systemName,
+            previous_hash,
+        };
+        const hash = sha256Hex(serializeForHash(base));
+        const entry = { ...base, hash };
+        fs.mkdirSync(path.dirname(this.logPath), { recursive: true });
+        fs.appendFileSync(this.logPath, JSON.stringify(entry) + '\n', 'utf8');
+        this.lastHash = hash;
+        return entry;
+    }
+    readAll() {
+        if (!fs.existsSync(this.logPath))
+            return [];
+        return fs
+            .readFileSync(this.logPath, 'utf8')
+            .trim()
+            .split('\n')
+            .filter(Boolean)
+            .map((line) => JSON.parse(line));
+    }
+    exportJson(fromIso) {
+        const all = this.readAll();
+        if (!fromIso)
+            return all;
+        const from = Date.parse(fromIso);
+        return all.filter((e) => Date.parse(e.timestamp) >= from);
+    }
+    verifyChain() {
+        const all = this.readAll();
+        let prev = null;
+        for (let i = 0; i < all.length; i++) {
+            const e = all[i];
+            if (e.previous_hash !== prev)
+                return { ok: false, brokenAt: i };
+            const expected = sha256Hex(serializeForHash({
+                id: e.id,
+                timestamp: e.timestamp,
+                system: e.system,
+                action: e.action,
+                model: e.model,
+                purpose: e.purpose,
+                input_type: e.input_type,
+                contains_pii: e.contains_pii,
+                human_oversight: e.human_oversight,
+                response_time_ms: e.response_time_ms,
+                tokens_used: e.tokens_used,
+                error: e.error,
+                previous_hash: e.previous_hash,
+            }));
+            if (expected !== e.hash)
+                return { ok: false, brokenAt: i };
+            prev = e.hash;
+        }
+        return { ok: true };
+    }
+}
+//# sourceMappingURL=audit-logger.js.map

package/dist/audit-logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-logger.js","sourceRoot":"","sources":["../src/audit-logger.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAmBrD,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,gBAAgB,CAAC,KAA+B;IACvD,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,aAAa,EAAE,KAAK,CAAC,aAAa;KACnC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,OAAO,WAAW;IACL,OAAO,CAAS;IAChB,UAAU,CAAS;IAC5B,QAAQ,GAAkB,IAAI,CAAC;IAEvC,YAAY,OAAe,EAAE,UAAkB;QAC7C,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,YAAY,EAAE,CAAC;IACtB,CAAC;IAEO,YAAY;QAClB,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACjC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;YACrB,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACvF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;YACrB,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAE,CAAe,CAAC;YAChE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACvB,CAAC;IACH,CAAC;IAED,uFAAuF;IACvF,MAAM,CACJ,OAEC;QAED,MAAM,EAAE,GAAG,OAAO,UAAU,EAAE,EAAE,CAAC;QACjC,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC3C,MAAM,aAAa,GAAG,IAAI,CAAC,QAAQ,CAAC;QACpC,MAAM,IAAI,GAA6B;YACrC,GAAG,OAAO;YACV,EAAE;YACF,SAAS;YACT,MAAM,EAAE,IAAI,CAAC,UAAU;YACvB,aAAa;SACd,CAAC;QACF,MAAM,IAAI,GAAG,SAAS,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/C,MAAM,KAAK,GAAe,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,CAAC;QAC5C,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9D,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;QACtE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO;QACL,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,CAAC;QAC5C,OAAO,EAAE;aACN,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC;aAClC,IAAI,EAAE;aACN,KAAK,CAAC,IAAI,CAAC;aACX,MAAM,CAAC,OAAO,CAAC;aACf,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAe,CAAC,CAAC;IACnD,CAAC;IAED,UAAU,CAAC,OAAgB;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QAC3B,IAAI,CAAC,OAAO;YAAE,OAAO,GAAG,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACjC,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,CAAC;IAC5D,CAAC;IAED,WAAW;QACT,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QAC3B,IAAI,IAAI,GAAkB,IAAI,CAAC;QAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACpC,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAE,CAAC;YAClB,IAAI,CAAC,CAAC,aAAa,KAAK,IAAI;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;YAChE,MAAM,QAAQ,GAAG,SAAS,CACxB,gBAAgB,CAAC;gBACf,EAAE,EAAE,CAAC,CAAC,EAAE;gBACR,SAAS,EAAE,CAAC,CAAC,SAAS;gBACtB,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,UAAU,EAAE,CAAC,CAAC,UAAU;gBACxB,YAAY,EAAE,CAAC,CAAC,YAAY;gBAC5B,eAAe,EAAE,CAAC,CAAC,eAAe;gBAClC,gBAAgB,EAAE,CAAC,CAAC,gBAAgB;gBACpC,WAAW,EAAE,CAAC,CAAC,WAAW;gBAC1B,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,aAAa,EAAE,CAAC,CAAC,aAAa;aAC/B,CAAC,CACH,CAAC;YACF,IAAI,QAAQ,KAAK,CAAC,CAAC,IAAI;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;YAC3D,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;QAChB,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;CACF"}

package/dist/compliance-checker.d.ts

@@ -0,0 +1,3 @@
+import type { ComplianceReport, ScanResult } from './types.js';
+export declare function checkCompliance(scan: ScanResult, rootDir?: string): ComplianceReport;
+//# sourceMappingURL=compliance-checker.d.ts.map

package/dist/compliance-checker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"compliance-checker.d.ts","sourceRoot":"","sources":["../src/compliance-checker.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAmB,gBAAgB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AA+DhF,wBAAgB,eAAe,CAC7B,IAAI,EAAE,UAAU,EAChB,OAAO,GAAE,MAAqB,GAC7B,gBAAgB,CAuDlB"}

package/dist/compliance-checker.js

@@ -0,0 +1,109 @@
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+const TRANSPARENCY_PATTERNS = [
+    /artificial intelligence/i,
+    /\bai[-\s]generated\b/i,
+    /\bthis (chat|conversation|message) (is|was) (powered|created) by\b/i,
+    /powered by ai/i,
+    /@asterpay\/attest/i,
+    /attest\.disclosure/i,
+    /eu ai act/i,
+];
+const LOGGING_PATTERNS = [
+    /@asterpay\/attest-sdk/i,
+    /attest\.track/i,
+    /audit.?log/i,
+    /compliance.?log/i,
+];
+const OVERSIGHT_PATTERNS = [
+    /human.?in.?the.?loop/i,
+    /human.?oversight/i,
+    /humanOversight/i,
+    /requireApproval/i,
+    /approval.?gate/i,
+];
+function readProjectCorpus(rootDir, maxBytes = 1_500_000) {
+    const chunks = [];
+    let total = 0;
+    const walk = (dir) => {
+        let entries;
+        try {
+            entries = fs.readdirSync(dir, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const e of entries) {
+            if (e.name === 'node_modules' ||
+                e.name === '.git' ||
+                e.name === 'dist' ||
+                e.name === '.next')
+                continue;
+            const full = path.join(dir, e.name);
+            if (e.isDirectory())
+                walk(full);
+            else if (/\.(ts|tsx|js|jsx|mdx?|vue|svelte)$/i.test(e.name)) {
+                try {
+                    const buf = fs.readFileSync(full);
+                    if (total + buf.length > maxBytes)
+                        return;
+                    total += buf.length;
+                    chunks.push(buf.toString('utf8'));
+                }
+                catch {
+                    /* ignore */
+                }
+            }
+        }
+    };
+    walk(rootDir);
+    return chunks.join('\n');
+}
+export function checkCompliance(scan, rootDir = scan.rootDir) {
+    const corpus = readProjectCorpus(rootDir);
+    const checks = [];
+    const hasAi = scan.packagesDetected.length > 0;
+    checks.push({
+        id: 'ai-usage',
+        label: 'AI SDK usage detected',
+        status: hasAi ? 'pass' : 'warn',
+        detail: hasAi
+            ? `Packages: ${scan.packagesDetected.join(', ')}`
+            : 'No known AI SDK imports found (may still use REST or other paths).',
+    });
+    const transparency = TRANSPARENCY_PATTERNS.some((re) => re.test(corpus));
+    checks.push({
+        id: 'transparency',
+        label: 'Transparency / disclosure signals',
+        status: hasAi ? (transparency ? 'pass' : 'fail') : 'warn',
+        detail: transparency
+            ? 'Found disclosure-related patterns in source.'
+            : hasAi
+                ? 'No obvious user-facing AI disclosure pattern detected — Article 50 style transparency may be required.'
+                : 'N/A without AI usage.',
+    });
+    const logging = LOGGING_PATTERNS.some((re) => re.test(corpus));
+    checks.push({
+        id: 'logging',
+        label: 'Logging / attest integration signals',
+        status: hasAi ? (logging ? 'pass' : 'warn') : 'warn',
+        detail: logging
+            ? 'Found logging or @asterpay/attest usage hints.'
+            : 'Consider structured logging for AI inferences (Article 12 style record-keeping for high-risk systems).',
+    });
+    const oversight = OVERSIGHT_PATTERNS.some((re) => re.test(corpus));
+    checks.push({
+        id: 'oversight',
+        label: 'Human oversight signals',
+        status: hasAi ? (oversight ? 'pass' : 'warn') : 'warn',
+        detail: oversight
+            ? 'Found human oversight related patterns.'
+            : 'No human oversight patterns detected — may be required for high-risk deployments (Article 14).',
+    });
+    const pass = checks.filter((c) => c.status === 'pass').length;
+    const fail = checks.filter((c) => c.status === 'fail').length;
+    const warn = checks.filter((c) => c.status === 'warn').length;
+    const score = Math.max(0, Math.min(100, Math.round((pass * 100 - fail * 25 - warn * 10) / checks.length)));
+    return { checks, score };
+}
+//# sourceMappingURL=compliance-checker.js.map

package/dist/compliance-checker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"compliance-checker.js","sourceRoot":"","sources":["../src/compliance-checker.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAGlC,MAAM,qBAAqB,GAAG;IAC5B,0BAA0B;IAC1B,uBAAuB;IACvB,qEAAqE;IACrE,gBAAgB;IAChB,oBAAoB;IACpB,qBAAqB;IACrB,YAAY;CACb,CAAC;AAEF,MAAM,gBAAgB,GAAG;IACvB,wBAAwB;IACxB,gBAAgB;IAChB,aAAa;IACb,kBAAkB;CACnB,CAAC;AAEF,MAAM,kBAAkB,GAAG;IACzB,uBAAuB;IACvB,mBAAmB;IACnB,iBAAiB;IACjB,kBAAkB;IAClB,iBAAiB;CAClB,CAAC;AAEF,SAAS,iBAAiB,CAAC,OAAe,EAAE,QAAQ,GAAG,SAAS;IAC9D,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,IAAI,GAAG,CAAC,GAAW,EAAQ,EAAE;QACjC,IAAI,OAAoB,CAAC;QACzB,IAAI,CAAC;YACH,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,IACE,CAAC,CAAC,IAAI,KAAK,cAAc;gBACzB,CAAC,CAAC,IAAI,KAAK,MAAM;gBACjB,CAAC,CAAC,IAAI,KAAK,MAAM;gBACjB,CAAC,CAAC,IAAI,KAAK,OAAO;gBAElB,SAAS;YACX,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;YACpC,IAAI,CAAC,CAAC,WAAW,EAAE;gBAAE,IAAI,CAAC,IAAI,CAAC,CAAC;iBAC3B,IAAI,qCAAqC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC5D,IAAI,CAAC;oBACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;oBAClC,IAAI,KAAK,GAAG,GAAG,CAAC,MAAM,GAAG,QAAQ;wBAAE,OAAO;oBAC1C,KAAK,IAAI,GAAG,CAAC,MAAM,CAAC;oBACpB,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;gBACpC,CAAC;gBAAC,MAAM,CAAC;oBACP,YAAY;gBACd,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IACF,IAAI,CAAC,OAAO,CAAC,CAAC;IACd,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,IAAgB,EAChB,UAAkB,IAAI,CAAC,OAAO;IAE9B,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAsB,EAAE,CAAC;IAErC,MAAM,KAAK,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC;IAC/C,MAAM,CAAC,IAAI,CAAC;QACV,EAAE,EAAE,UAAU;QACd,KAAK,EAAE,uBAAuB;QAC9B,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;QAC/B,MAAM,EAAE,KAAK;YACX,CAAC,CAAC,aAAa,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YACjD,CAAC,CAAC,oEAAoE;KACzE,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IACzE,MAAM,CAAC,IAAI,CAAC;QACV,EAAE,EAAE,cAAc;QAClB,KAAK,EAAE,mCAAmC;QAC1C,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM;QACzD,MAAM,EAAE,YAAY;YAClB,CAAC,CAAC,8CAA8C;YAChD,CAAC,CAAC,KAAK;gBACL,CAAC,CAAC,wGAAwG;gBAC1G,CAAC,CAAC,uBAAuB;KAC9B,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/D,MAAM,CAAC,IAAI,CAAC;QACV,EAAE,EAAE,SAAS;QACb,KAAK,EAAE,sCAAsC;QAC7C,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM;QACpD,MAAM,EAAE,OAAO;YACb,CAAC,CAAC,gDAAgD;YAClD,CAAC,CAAC,wGAAwG;KAC7G,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IACnE,MAAM,CAAC,IAAI,CAAC;QACV,EAAE,EAAE,WAAW;QACf,KAAK,EAAE,yBAAyB;QAChC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM;QACtD,MAAM,EAAE,SAAS;YACf,CAAC,CAAC,yCAAyC;YAC3C,CAAC,CAAC,gGAAgG;KACrG,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;IAC9D,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;IAC9D,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;IAC9D,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CACpB,CAAC,EACD,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,GAAG,GAAG,GAAG,IAAI,GAAG,EAAE,GAAG,IAAI,GAAG,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAChF,CAAC;IAEF,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AAC3B,CAAC"}

package/dist/docs-generator.d.ts

@@ -0,0 +1,12 @@
+import type { RiskClassification, ScanResult } from './types.js';
+export interface GenerateAnnexIvOptions {
+    outputDir: string;
+    systemName: string;
+    provider: string;
+    description?: string;
+    language?: string;
+}
+export declare function generateAnnexIvDocs(scan: ScanResult, risk: RiskClassification, opts: GenerateAnnexIvOptions): {
+    files: string[];
+};
+//# sourceMappingURL=docs-generator.d.ts.map

package/dist/docs-generator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"docs-generator.d.ts","sourceRoot":"","sources":["../src/docs-generator.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAEjE,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAMD,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,UAAU,EAChB,IAAI,EAAE,kBAAkB,EACxB,IAAI,EAAE,sBAAsB,GAC3B;IAAE,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CA8IrB"}

package/dist/docs-generator.js

@@ -0,0 +1,143 @@
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+function mdEscape(s) {
+    return s.replace(/\|/g, '\\|');
+}
+export function generateAnnexIvDocs(scan, risk, opts) {
+    const out = path.resolve(opts.outputDir);
+    fs.mkdirSync(out, { recursive: true });
+    const lang = opts.language ?? 'en';
+    const files = [];
+    const technical = `---
+title: Technical Documentation (Annex IV style outline)
+language: ${lang}
+generated_by: "@asterpay/attest-sdk"
+---
+
+# Technical documentation — ${mdEscape(opts.systemName)}
+
+> **Disclaimer:** This is a developer-generated scaffold to support EU AI Act documentation work. It is **not** legal advice and does not replace conformity assessment or counsel.
+
+## 1. General description
+
+| Field | Value |
+|-------|-------|
+| System name | ${mdEscape(opts.systemName)} |
+| Provider / deployer | ${mdEscape(opts.provider)} |
+| Description | ${mdEscape(opts.description ?? '—')} |
+| Scanned root | \`${mdEscape(scan.rootDir)}\` |
+| Files scanned | ${scan.filesScanned} |
+
+## 2. Intended purpose
+
+Describe the intended purpose, end-users, and context of deployment. (Fill manually.)
+
+## 3. AI components detected (automated scan)
+
+The following third-party AI-related packages were detected from import analysis:
+
+${scan.packagesDetected.length ? scan.packagesDetected.map((p) => `- \`${mdEscape(p)}\``).join('\n') : '_None detected — verify REST/SDK usage not covered by static scan._'}
+
+### Findings detail
+
+| Package | File | Line | Kind |
+|---------|------|------|------|
+${scan.findings.length ? scan.findings.map((f) => `| ${mdEscape(f.packageName)} | ${mdEscape(f.filePath)} | ${f.line} | ${f.kind} |`).join('\n') : '| — | — | — | — |'}
+
+## 4. Risk classification (heuristic)
+
+| Field | Value |
+|-------|-------|
+| Level | **${risk.level}** |
+| Rationale | ${mdEscape(risk.reason)} |
+| Relevant articles (indicative) | ${risk.articles.join(', ') || '—'} |
+
+### Warnings
+
+${risk.warnings.length ? risk.warnings.map((w) => `- ${mdEscape(w)}`).join('\n') : '_None_'}
+
+## 5. Data governance (Article 10) — template
+
+- Training data: _N/A / describe_
+- Input data: _describe categories, retention, minimisation_
+- Data quality measures: _describe_
+
+## 6. Record-keeping & logging (Article 12) — template
+
+- Log fields: model, purpose, timestamps, human oversight flags, PII flags.
+- Retention policy: _define_
+- Tamper-evidence: use \`@asterpay/attest-sdk\` audit log hash chain where applicable.
+
+## 7. Transparency (Article 13 / limited-risk) — template
+
+- User-facing disclosures: _link to UI copy_
+- Machine-readable metadata: _optional_
+
+## 8. Human oversight (Article 14) — template
+
+- Override mechanisms: _describe_
+- Human review workflows: _describe_
+
+## 9. Accuracy, robustness, cybersecurity (Article 15) — template
+
+- Testing strategy: _describe_
+- Monitoring: _describe_
+- Incident process: _describe_
+
+## 10. Conformity & registration
+
+- Conformity assessment route: _self / third-party_
+- EU database registration: _status / ID_
+
+---
+
+_Generated by Attest — Powered by AsterPay._
+`;
+    const riskMd = `---
+title: Risk assessment (working draft)
+---
+
+# Risk assessment — ${mdEscape(opts.systemName)}
+
+## Summary
+
+- **Heuristic risk level:** ${risk.level}
+- **Reason:** ${mdEscape(risk.reason)}
+
+## Risk management system (Article 9)
+
+Document identification, analysis, evaluation, and mitigation of risks throughout the lifecycle. (Fill manually.)
+
+## Post-market monitoring
+
+Describe monitoring, feedback loops, and update policy. (Fill manually.)
+`;
+    const decl = `---
+title: EU Declaration of Conformity (template)
+---
+
+# EU Declaration of Conformity — template
+
+> Complete with legal review. This file is a non-binding placeholder.
+
+1. AI system name: **${mdEscape(opts.systemName)}**
+2. Provider: **${mdEscape(opts.provider)}**
+3. The AI system complies with the requirements of Regulation (EU) 2024/1689 (EU AI Act) for the indicated risk class.
+4. References to harmonised standards / specifications: _fill_
+5. Notified body (if applicable): _fill_
+6. Place, date, signature.
+
+---
+
+_Attest scaffold — not a signed legal document._
+`;
+    const p1 = path.join(out, 'technical-documentation.md');
+    const p2 = path.join(out, 'risk-assessment.md');
+    const p3 = path.join(out, 'conformity-declaration.md');
+    fs.writeFileSync(p1, technical, 'utf8');
+    fs.writeFileSync(p2, riskMd, 'utf8');
+    fs.writeFileSync(p3, decl, 'utf8');
+    files.push(p1, p2, p3);
+    return { files };
+}
+//# sourceMappingURL=docs-generator.js.map

package/dist/docs-generator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"docs-generator.js","sourceRoot":"","sources":["../src/docs-generator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAWlC,SAAS,QAAQ,CAAC,CAAS;IACzB,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,IAAgB,EAChB,IAAwB,EACxB,IAA4B;IAE5B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACzC,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAEvC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC;IACnC,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,MAAM,SAAS,GAAG;;YAER,IAAI;;;;8BAIc,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC;;;;;;;;kBAQrC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC;0BACjB,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC;kBAC/B,QAAQ,CAAC,IAAI,CAAC,WAAW,IAAI,GAAG,CAAC;qBAC9B,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC;oBACvB,IAAI,CAAC,YAAY;;;;;;;;;;EAUnC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,qEAAqE;;;;;;EAM1K,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,mBAAmB;;;;;;cAMxJ,IAAI,CAAC,KAAK;gBACR,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC;qCACA,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG;;;;EAIlE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsC1F,CAAC;IAEA,MAAM,MAAM,GAAG;;;;sBAIK,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC;;;;8BAIjB,IAAI,CAAC,KAAK;gBACxB,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC;;;;;;;;;CASpC,CAAC;IAEA,MAAM,IAAI,GAAG;;;;;;;;uBAQQ,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC;iBAC/B,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC;;;;;;;;;CASvC,CAAC;IAEA,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,4BAA4B,CAAC,CAAC;IACxD,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;IAChD,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,2BAA2B,CAAC,CAAC;IACvD,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IACxC,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IACnC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;IAEvB,OAAO,EAAE,KAAK,EAAE,CAAC;AACnB,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,12 @@
+export { AI_SDK_PACKAGES, HIGH_RISK_KEYWORDS, PROHIBITED_KEYWORDS } from './ai-packages.js';
+export { Attest, defaultAuditPath } from './attest.js';
+export { AuditLogger } from './audit-logger.js';
+export type { AuditEntry } from './audit-logger.js';
+export { checkCompliance } from './compliance-checker.js';
+export { classifyRisk, riskLevelOrder } from './risk-classifier.js';
+export { generateAnnexIvDocs } from './docs-generator.js';
+export { scanProject } from './scanner.js';
+export { getDisclosure } from './transparency.js';
+export type { DisclosureLocale } from './transparency.js';
+export type { AttestConfig, AttestEuConfig, AttestSystemConfig, ComplianceCheck, ComplianceReport, ComplianceStatus, ExportAuditOptions, GenerateDocsOptions, RiskClassification, RiskLevel, ScanFinding, ScanResult, TrackMeta, } from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAC5F,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,YAAY,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAE1D,YAAY,EACV,YAAY,EACZ,cAAc,EACd,kBAAkB,EAClB,eAAe,EACf,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,SAAS,EACT,WAAW,EACX,UAAU,EACV,SAAS,GACV,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -0,0 +1,9 @@
+export { AI_SDK_PACKAGES, HIGH_RISK_KEYWORDS, PROHIBITED_KEYWORDS } from './ai-packages.js';
+export { Attest, defaultAuditPath } from './attest.js';
+export { AuditLogger } from './audit-logger.js';
+export { checkCompliance } from './compliance-checker.js';
+export { classifyRisk, riskLevelOrder } from './risk-classifier.js';
+export { generateAnnexIvDocs } from './docs-generator.js';
+export { scanProject } from './scanner.js';
+export { getDisclosure } from './transparency.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAC5F,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/risk-classifier.d.ts

@@ -0,0 +1,8 @@
+import type { RiskClassification, RiskLevel, ScanResult } from './types.js';
+export interface ClassifyContext {
+    /** Combined source text hint (optional; if omitted, reads from disk). */
+    corpus?: string;
+}
+export declare function classifyRisk(scan: ScanResult, context?: ClassifyContext): RiskClassification;
+export declare function riskLevelOrder(level: RiskLevel): number;
+//# sourceMappingURL=risk-classifier.d.ts.map

package/dist/risk-classifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"risk-classifier.d.ts","sourceRoot":"","sources":["../src/risk-classifier.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,kBAAkB,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAgC5E,MAAM,WAAW,eAAe;IAC9B,yEAAyE;IACzE,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wBAAgB,YAAY,CAC1B,IAAI,EAAE,UAAU,EAChB,OAAO,CAAC,EAAE,eAAe,GACxB,kBAAkB,CAwDpB;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM,CAQvD"}

package/dist/risk-classifier.js

@@ -0,0 +1,95 @@
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { HIGH_RISK_KEYWORDS, PROHIBITED_KEYWORDS, } from './ai-packages.js';
+function readAllSourceText(rootDir, maxBytes = 2_000_000) {
+    const parts = [];
+    let total = 0;
+    const walk = (dir) => {
+        let entries;
+        try {
+            entries = fs.readdirSync(dir, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const e of entries) {
+            if (e.name === 'node_modules' || e.name === '.git' || e.name === 'dist')
+                continue;
+            const full = path.join(dir, e.name);
+            if (e.isDirectory())
+                walk(full);
+            else if (/\.(ts|tsx|js|jsx|md|json|env)$/i.test(e.name)) {
+                try {
+                    const buf = fs.readFileSync(full);
+                    if (total + buf.length > maxBytes)
+                        return;
+                    total += buf.length;
+                    parts.push(buf.toString('utf8'));
+                }
+                catch {
+                    /* ignore */
+                }
+            }
+        }
+    };
+    walk(rootDir);
+    return parts.join('\n').toLowerCase();
+}
+export function classifyRisk(scan, context) {
+    const warnings = [];
+    const articles = [];
+    const corpus = context?.corpus?.toLowerCase() ?? readAllSourceText(scan.rootDir);
+    for (const kw of PROHIBITED_KEYWORDS) {
+        if (corpus.includes(kw.toLowerCase())) {
+            return {
+                level: 'prohibited',
+                reason: `Possible prohibited practice indicated by keyword: "${kw}". Legal review required.`,
+                articles: ['Article 5'],
+                warnings: [
+                    'Heuristic scan only — not legal advice. Consult qualified counsel.',
+                ],
+            };
+        }
+    }
+    let highHit = false;
+    for (const kw of HIGH_RISK_KEYWORDS) {
+        if (corpus.includes(kw.toLowerCase())) {
+            highHit = true;
+            warnings.push(`High-risk context hint: "${kw}"`);
+        }
+    }
+    if (scan.packagesDetected.length === 0) {
+        return {
+            level: 'minimal',
+            reason: 'No known AI SDK imports detected in scanned files.',
+            articles: [],
+            warnings,
+        };
+    }
+    if (highHit) {
+        articles.push('Annex III', 'Articles 9–15', 'Article 26');
+        return {
+            level: 'high',
+            reason: 'AI SDK usage detected together with keywords suggesting Annex III high-risk domains (heuristic).',
+            articles,
+            warnings,
+        };
+    }
+    articles.push('Article 50');
+    return {
+        level: 'limited',
+        reason: 'AI SDK usage detected; likely transparency obligations for interactable AI (e.g. chatbots) under limited-risk rules.',
+        articles,
+        warnings,
+    };
+}
+export function riskLevelOrder(level) {
+    const o = {
+        minimal: 0,
+        limited: 1,
+        high: 2,
+        prohibited: 3,
+    };
+    return o[level];
+}
+//# sourceMappingURL=risk-classifier.js.map

package/dist/risk-classifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"risk-classifier.js","sourceRoot":"","sources":["../src/risk-classifier.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EACL,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAG1B,SAAS,iBAAiB,CAAC,OAAe,EAAE,QAAQ,GAAG,SAAS;IAC9D,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,IAAI,GAAG,CAAC,GAAW,EAAQ,EAAE;QACjC,IAAI,OAAoB,CAAC;QACzB,IAAI,CAAC;YACH,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,IAAI,CAAC,CAAC,IAAI,KAAK,cAAc,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM;gBAAE,SAAS;YAClF,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;YACpC,IAAI,CAAC,CAAC,WAAW,EAAE;gBAAE,IAAI,CAAC,IAAI,CAAC,CAAC;iBAC3B,IAAI,iCAAiC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxD,IAAI,CAAC;oBACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;oBAClC,IAAI,KAAK,GAAG,GAAG,CAAC,MAAM,GAAG,QAAQ;wBAAE,OAAO;oBAC1C,KAAK,IAAI,GAAG,CAAC,MAAM,CAAC;oBACpB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;gBACnC,CAAC;gBAAC,MAAM,CAAC;oBACP,YAAY;gBACd,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IACF,IAAI,CAAC,OAAO,CAAC,CAAC;IACd,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;AACxC,CAAC;AAOD,MAAM,UAAU,YAAY,CAC1B,IAAgB,EAChB,OAAyB;IAEzB,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,MAAM,MAAM,GACV,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAEpE,KAAK,MAAM,EAAE,IAAI,mBAAmB,EAAE,CAAC;QACrC,IAAI,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YACtC,OAAO;gBACL,KAAK,EAAE,YAAY;gBACnB,MAAM,EAAE,uDAAuD,EAAE,2BAA2B;gBAC5F,QAAQ,EAAE,CAAC,WAAW,CAAC;gBACvB,QAAQ,EAAE;oBACR,oEAAoE;iBACrE;aACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,MAAM,EAAE,IAAI,kBAAkB,EAAE,CAAC;QACpC,IAAI,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YACtC,OAAO,GAAG,IAAI,CAAC;YACf,QAAQ,CAAC,IAAI,CAAC,4BAA4B,EAAE,GAAG,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IAED,IAAI,IAAI,CAAC,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvC,OAAO;YACL,KAAK,EAAE,SAAS;YAChB,MAAM,EAAE,oDAAoD;YAC5D,QAAQ,EAAE,EAAE;YACZ,QAAQ;SACT,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,EAAE,CAAC;QACZ,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,eAAe,EAAE,YAAY,CAAC,CAAC;QAC1D,OAAO;YACL,KAAK,EAAE,MAAM;YACb,MAAM,EACJ,kGAAkG;YACpG,QAAQ;YACR,QAAQ;SACT,CAAC;IACJ,CAAC;IAED,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC5B,OAAO;QACL,KAAK,EAAE,SAAS;QAChB,MAAM,EACJ,sHAAsH;QACxH,QAAQ;QACR,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAgB;IAC7C,MAAM,CAAC,GAA8B;QACnC,OAAO,EAAE,CAAC;QACV,OAAO,EAAE,CAAC;QACV,IAAI,EAAE,CAAC;QACP,UAAU,EAAE,CAAC;KACd,CAAC;IACF,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC;AAClB,CAAC"}

package/dist/scanner.d.ts

@@ -0,0 +1,6 @@
+import type { ScanResult } from './types.js';
+export interface ScanOptions {
+    rootDir: string;
+}
+export declare function scanProject(options: ScanOptions): ScanResult;
+//# sourceMappingURL=scanner.d.ts.map

package/dist/scanner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanner.d.ts","sourceRoot":"","sources":["../src/scanner.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAe,UAAU,EAAE,MAAM,YAAY,CAAC;AAwI1D,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,wBAAgB,WAAW,CAAC,OAAO,EAAE,WAAW,GAAG,UAAU,CA8B5D"}

package/dist/scanner.js

@@ -0,0 +1,151 @@
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import * as ts from 'typescript';
+import { AI_SDK_PACKAGES } from './ai-packages.js';
+const SKIP_DIRS = new Set([
+    'node_modules',
+    '.git',
+    'dist',
+    'build',
+    '.next',
+    'coverage',
+    '.turbo',
+    'vendor',
+]);
+const EXT = new Set(['.ts', '.tsx', '.mts', '.cts', '.js', '.jsx', '.mjs', '.cjs']);
+const AI_SET = new Set(AI_SDK_PACKAGES.map((p) => p.toLowerCase()));
+function normalizeSpecifier(spec) {
+    const s = spec.trim();
+    if (!s || s.startsWith('.'))
+        return null;
+    const bare = s.startsWith('@')
+        ? s.split('/').slice(0, 2).join('/')
+        : s.split('/')[0] ?? s;
+    return bare?.toLowerCase() ?? null;
+}
+function matchesAiPackage(spec) {
+    const n = normalizeSpecifier(spec);
+    if (!n)
+        return null;
+    if (AI_SET.has(n))
+        return n;
+    for (const p of AI_SDK_PACKAGES) {
+        if (n === p.toLowerCase() || n.startsWith(`${p.toLowerCase()}/`))
+            return p;
+    }
+    return null;
+}
+function walkDir(dir, out) {
+    let entries;
+    try {
+        entries = fs.readdirSync(dir, { withFileTypes: true });
+    }
+    catch {
+        return;
+    }
+    for (const e of entries) {
+        if (e.name.startsWith('.'))
+            continue;
+        const full = path.join(dir, e.name);
+        if (e.isDirectory()) {
+            if (SKIP_DIRS.has(e.name))
+                continue;
+            walkDir(full, out);
+        }
+        else if (e.isFile()) {
+            const ext = path.extname(e.name);
+            if (EXT.has(ext))
+                out.push(full);
+        }
+    }
+}
+function getLine(source, pos) {
+    return source.slice(0, pos).split('\n').length;
+}
+function scriptKindForPath(absPath) {
+    const lower = absPath.toLowerCase();
+    if (lower.endsWith('.tsx'))
+        return ts.ScriptKind.TSX;
+    if (lower.endsWith('.jsx'))
+        return ts.ScriptKind.JSX;
+    if (lower.endsWith('.js') || lower.endsWith('.mjs') || lower.endsWith('.cjs'))
+        return ts.ScriptKind.JS;
+    return ts.ScriptKind.TS;
+}
+function visitSource(filePath, absPath, content, findings) {
+    const sf = ts.createSourceFile(filePath, content, ts.ScriptTarget.Latest, true, scriptKindForPath(absPath));
+    const visit = (node) => {
+        if (ts.isImportDeclaration(node) && node.moduleSpecifier && ts.isStringLiteral(node.moduleSpecifier)) {
+            const spec = node.moduleSpecifier.text;
+            const pkg = matchesAiPackage(spec);
+            if (pkg) {
+                findings.push({
+                    packageName: pkg,
+                    filePath,
+                    line: getLine(content, node.getStart(sf)),
+                    kind: 'import',
+                });
+            }
+        }
+        if (ts.isCallExpression(node)) {
+            const expr = node.expression;
+            if (ts.isIdentifier(expr) && expr.text === 'require' && node.arguments.length > 0) {
+                const arg0 = node.arguments[0];
+                if (ts.isStringLiteral(arg0)) {
+                    const pkg = matchesAiPackage(arg0.text);
+                    if (pkg) {
+                        findings.push({
+                            packageName: pkg,
+                            filePath,
+                            line: getLine(content, node.getStart(sf)),
+                            kind: 'require',
+                        });
+                    }
+                }
+            }
+            // dynamic import('pkg')
+            if (expr.kind === ts.SyntaxKind.ImportKeyword && node.arguments.length > 0) {
+                const arg0 = node.arguments[0];
+                if (ts.isStringLiteral(arg0)) {
+                    const pkg = matchesAiPackage(arg0.text);
+                    if (pkg) {
+                        findings.push({
+                            packageName: pkg,
+                            filePath,
+                            line: getLine(content, node.getStart(sf)),
+                            kind: 'dynamic_import',
+                        });
+                    }
+                }
+            }
+        }
+        ts.forEachChild(node, visit);
+    };
+    visit(sf);
+}
+export function scanProject(options) {
+    const rootDir = path.resolve(options.rootDir);
+    const files = [];
+    walkDir(rootDir, files);
+    const findings = [];
+    let scanned = 0;
+    for (const file of files) {
+        let content;
+        try {
+            content = fs.readFileSync(file, 'utf8');
+        }
+        catch {
+            continue;
+        }
+        scanned += 1;
+        visitSource(path.relative(rootDir, file).replace(/\\/g, '/'), file, content, findings);
+    }
+    const packagesDetected = [...new Set(findings.map((f) => f.packageName))].sort();
+    return {
+        rootDir,
+        filesScanned: scanned,
+        findings,
+        packagesDetected,
+    };
+}
+//# sourceMappingURL=scanner.js.map

package/dist/scanner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanner.js","sourceRoot":"","sources":["../src/scanner.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,YAAY,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAGnD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC;IACxB,cAAc;IACd,MAAM;IACN,MAAM;IACN,OAAO;IACP,OAAO;IACP,UAAU;IACV,QAAQ;IACR,QAAQ;CACT,CAAC,CAAC;AAEH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAEpF,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AAEpE,SAAS,kBAAkB,CAAC,IAAY;IACtC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IACtB,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;QAC5B,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QACpC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACzB,OAAO,IAAI,EAAE,WAAW,EAAE,IAAI,IAAI,CAAC;AACrC,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY;IACpC,MAAM,CAAC,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACnC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC;IAC5B,KAAK,MAAM,CAAC,IAAI,eAAe,EAAE,CAAC;QAChC,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC;YAAE,OAAO,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,OAAO,CAAC,GAAW,EAAE,GAAa;IACzC,IAAI,OAAoB,CAAC;IACzB,IAAI,CAAC;QACH,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QACrC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;YACpB,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;gBAAE,SAAS;YACpC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACrB,CAAC;aAAM,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;YACtB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACjC,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,MAAc,EAAE,GAAW;IAC1C,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;AACjD,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAe;IACxC,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IACpC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;IACrD,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;IACrD,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC3E,OAAO,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;IAC1B,OAAO,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;AAC1B,CAAC;AAED,SAAS,WAAW,CAClB,QAAgB,EAChB,OAAe,EACf,OAAe,EACf,QAAuB;IAEvB,MAAM,EAAE,GAAG,EAAE,CAAC,gBAAgB,CAC5B,QAAQ,EACR,OAAO,EACP,EAAE,CAAC,YAAY,CAAC,MAAM,EACtB,IAAI,EACJ,iBAAiB,CAAC,OAAO,CAAC,CAC3B,CAAC;IAEF,MAAM,KAAK,GAAG,CAAC,IAAa,EAAQ,EAAE;QACpC,IAAI,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,eAAe,IAAI,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;YACrG,MAAM,IAAI,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;YACvC,MAAM,GAAG,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;YACnC,IAAI,GAAG,EAAE,CAAC;gBACR,QAAQ,CAAC,IAAI,CAAC;oBACZ,WAAW,EAAE,GAAG;oBAChB,QAAQ;oBACR,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;oBACzC,IAAI,EAAE,QAAQ;iBACf,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,IAAI,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC;YAC7B,IAAI,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAClF,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;gBAC/B,IAAI,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC7B,MAAM,GAAG,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBACxC,IAAI,GAAG,EAAE,CAAC;wBACR,QAAQ,CAAC,IAAI,CAAC;4BACZ,WAAW,EAAE,GAAG;4BAChB,QAAQ;4BACR,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;4BACzC,IAAI,EAAE,SAAS;yBAChB,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;YACD,wBAAwB;YACxB,IAAI,IAAI,CAAC,IAAI,KAAK,EAAE,CAAC,UAAU,CAAC,aAAa,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3E,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;gBAC/B,IAAI,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC7B,MAAM,GAAG,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBACxC,IAAI,GAAG,EAAE,CAAC;wBACR,QAAQ,CAAC,IAAI,CAAC;4BACZ,WAAW,EAAE,GAAG;4BAChB,QAAQ;4BACR,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;4BACzC,IAAI,EAAE,gBAAgB;yBACvB,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC/B,CAAC,CAAC;IAEF,KAAK,CAAC,EAAE,CAAC,CAAC;AACZ,CAAC;AAMD,MAAM,UAAU,WAAW,CAAC,OAAoB;IAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAExB,MAAM,QAAQ,GAAkB,EAAE,CAAC;IACnC,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,OAAO,IAAI,CAAC,CAAC;QACb,WAAW,CACT,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,EAChD,IAAI,EACJ,OAAO,EACP,QAAQ,CACT,CAAC;IACJ,CAAC;IAED,MAAM,gBAAgB,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACjF,OAAO;QACL,OAAO;QACP,YAAY,EAAE,OAAO;QACrB,QAAQ;QACR,gBAAgB;KACjB,CAAC;AACJ,CAAC"}

package/dist/scanner.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=scanner.test.d.ts.map

package/dist/scanner.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanner.test.d.ts","sourceRoot":"","sources":["../src/scanner.test.ts"],"names":[],"mappings":""}

package/dist/scanner.test.js

@@ -0,0 +1,21 @@
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { describe, expect, it } from 'vitest';
+import { scanProject } from './scanner.js';
+describe('scanProject', () => {
+    it('detects openai import', () => {
+        const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'attest-scan-'));
+        fs.writeFileSync(path.join(dir, 'app.ts'), `import OpenAI from 'openai';\nconst x = new OpenAI();\n`, 'utf8');
+        const r = scanProject({ rootDir: dir });
+        expect(r.packagesDetected).toContain('openai');
+        expect(r.findings.some((f) => f.packageName === 'openai')).toBe(true);
+    });
+    it('detects require anthropic', () => {
+        const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'attest-scan-'));
+        fs.writeFileSync(path.join(dir, 'legacy.js'), `const Anthropic = require("@anthropic-ai/sdk");\n`, 'utf8');
+        const r = scanProject({ rootDir: dir });
+        expect(r.packagesDetected).toContain('@anthropic-ai/sdk');
+    });
+});
+//# sourceMappingURL=scanner.test.js.map

package/dist/scanner.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanner.test.js","sourceRoot":"","sources":["../src/scanner.test.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3C,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;IAC3B,EAAE,CAAC,uBAAuB,EAAE,GAAG,EAAE;QAC/B,MAAM,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,cAAc,CAAC,CAAC,CAAC;QACnE,EAAE,CAAC,aAAa,CACd,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,EACxB,yDAAyD,EACzD,MAAM,CACP,CAAC;QACF,MAAM,CAAC,GAAG,WAAW,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;QACxC,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACnC,MAAM,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,cAAc,CAAC,CAAC,CAAC;QACnE,EAAE,CAAC,aAAa,CACd,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,EAC3B,mDAAmD,EACnD,MAAM,CACP,CAAC;QACF,MAAM,CAAC,GAAG,WAAW,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;QACxC,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/transparency.d.ts

@@ -0,0 +1,5 @@
+export type DisclosureLocale = 'en' | 'fi' | 'de' | 'fr' | 'es' | 'nl' | 'it' | 'pt';
+export declare function getDisclosure(locale?: DisclosureLocale, options?: {
+    humanAvailable?: boolean;
+}): string;
+//# sourceMappingURL=transparency.d.ts.map

package/dist/transparency.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"transparency.d.ts","sourceRoot":"","sources":["../src/transparency.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,gBAAgB,GACxB,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,IAAI,CAAC;AAgDT,wBAAgB,aAAa,CAC3B,MAAM,GAAE,gBAAuB,EAC/B,OAAO,CAAC,EAAE;IAAE,cAAc,CAAC,EAAE,OAAO,CAAA;CAAE,GACrC,MAAM,CAGR"}

package/dist/transparency.js

@@ -0,0 +1,39 @@
+const MESSAGES = {
+    en: {
+        short: 'This experience may be powered by artificial intelligence.',
+        withHuman: 'This conversation is powered by artificial intelligence. A human operator is available upon request.',
+    },
+    fi: {
+        short: 'Tama kokemus voi perustua tekoalyyn.',
+        withHuman: 'Tama keskustelu kayttaa tekoalya. Ihminen on saatavilla pyynnosta.',
+    },
+    de: {
+        short: 'Dieses Erlebnis kann KI-gestutzt sein.',
+        withHuman: 'Dieses Gesprach wird durch kunstliche Intelligenz unterstutzt. Ein menschlicher Ansprechpartner ist auf Anfrage verfugbar.',
+    },
+    fr: {
+        short: 'Cette experience peut etre assistee par une intelligence artificielle.',
+        withHuman: 'Cette conversation est assistee par une intelligence artificielle. Un operateur humain est disponible sur demande.',
+    },
+    es: {
+        short: 'Esta experiencia puede estar asistida por inteligencia artificial.',
+        withHuman: 'Esta conversacion esta asistida por inteligencia artificial. Un operador humano esta disponible bajo solicitud.',
+    },
+    nl: {
+        short: 'Deze ervaring kan met kunstmatige intelligentie worden ondersteund.',
+        withHuman: 'Dit gesprek wordt ondersteund door kunstmatige intelligentie. Een menselijke medewerker is op verzoek beschikbaar.',
+    },
+    it: {
+        short: 'Questa esperienza puo essere supportata da intelligenza artificiale.',
+        withHuman: 'Questa conversazione e supportata da intelligenza artificiale. Un operatore umano e disponibile su richiesta.',
+    },
+    pt: {
+        short: 'Esta experiencia pode ser apoiada por inteligencia artificial.',
+        withHuman: 'Esta conversa e apoiada por inteligencia artificial. Um operador humano esta disponivel mediante pedido.',
+    },
+};
+export function getDisclosure(locale = 'en', options) {
+    const pack = MESSAGES[locale] ?? MESSAGES.en;
+    return options?.humanAvailable ? pack.withHuman : pack.short;
+}
+//# sourceMappingURL=transparency.js.map

package/dist/transparency.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"transparency.js","sourceRoot":"","sources":["../src/transparency.ts"],"names":[],"mappings":"AAUA,MAAM,QAAQ,GAGV;IACF,EAAE,EAAE;QACF,KAAK,EAAE,4DAA4D;QACnE,SAAS,EACP,sGAAsG;KACzG;IACD,EAAE,EAAE;QACF,KAAK,EAAE,sCAAsC;QAC7C,SAAS,EACP,oEAAoE;KACvE;IACD,EAAE,EAAE;QACF,KAAK,EAAE,wCAAwC;QAC/C,SAAS,EACP,4HAA4H;KAC/H;IACD,EAAE,EAAE;QACF,KAAK,EAAE,wEAAwE;QAC/E,SAAS,EACP,oHAAoH;KACvH;IACD,EAAE,EAAE;QACF,KAAK,EAAE,oEAAoE;QAC3E,SAAS,EACP,iHAAiH;KACpH;IACD,EAAE,EAAE;QACF,KAAK,EAAE,qEAAqE;QAC5E,SAAS,EACP,oHAAoH;KACvH;IACD,EAAE,EAAE;QACF,KAAK,EAAE,sEAAsE;QAC7E,SAAS,EACP,+GAA+G;KAClH;IACD,EAAE,EAAE;QACF,KAAK,EAAE,gEAAgE;QACvE,SAAS,EACP,0GAA0G;KAC7G;CACF,CAAC;AAEF,MAAM,UAAU,aAAa,CAC3B,SAA2B,IAAI,EAC/B,OAAsC;IAEtC,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,QAAQ,CAAC,EAAE,CAAC;IAC7C,OAAO,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC;AAC/D,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,63 @@
+export type RiskLevel = 'minimal' | 'limited' | 'high' | 'prohibited';
+export interface ScanFinding {
+    readonly packageName: string;
+    readonly filePath: string;
+    readonly line: number;
+    readonly kind: 'import' | 'require' | 'dynamic_import';
+}
+export interface ScanResult {
+    readonly rootDir: string;
+    readonly filesScanned: number;
+    readonly findings: ScanFinding[];
+    readonly packagesDetected: string[];
+}
+export interface RiskClassification {
+    readonly level: RiskLevel;
+    readonly reason: string;
+    readonly articles: string[];
+    readonly warnings: string[];
+}
+export type ComplianceStatus = 'pass' | 'fail' | 'warn';
+export interface ComplianceCheck {
+    readonly id: string;
+    readonly label: string;
+    readonly status: ComplianceStatus;
+    readonly detail: string;
+}
+export interface ComplianceReport {
+    readonly checks: ComplianceCheck[];
+    readonly score: number;
+}
+export interface AttestSystemConfig {
+    name: string;
+    provider: string;
+    description?: string;
+}
+export interface AttestEuConfig {
+    deployerCountry?: string;
+    registrationId?: string;
+}
+export interface AttestConfig {
+    system: AttestSystemConfig;
+    eu?: AttestEuConfig;
+    /** Optional path to project root for scans (default: cwd). */
+    projectRoot?: string;
+    /** Audit log file path (JSONL). */
+    auditLogPath?: string;
+}
+export interface TrackMeta {
+    purpose?: string;
+    humanOversight?: 'available' | 'required' | 'none';
+    containsPII?: boolean;
+    model?: string;
+}
+export interface GenerateDocsOptions {
+    outputDir: string;
+    format?: 'markdown';
+    language?: string;
+}
+export interface ExportAuditOptions {
+    format: 'json' | 'jsonl';
+    from?: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,MAAM,GAAG,YAAY,CAAC;AAEtE,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,SAAS,GAAG,gBAAgB,CAAC;CACxD;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAC;IACjC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,EAAE,CAAC;CACrC;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;CAC7B;AAED,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;AAExD,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,MAAM,EAAE,eAAe,EAAE,CAAC;IACnC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,kBAAkB,CAAC;IAC3B,EAAE,CAAC,EAAE,cAAc,CAAC;IACpB,8DAA8D;IAC9D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mCAAmC;IACnC,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,SAAS;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,WAAW,GAAG,UAAU,GAAG,MAAM,CAAC;IACnD,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;IACzB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf"}

package/dist/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}

package/package.json

@@ -0,0 +1,47 @@
+{
+  "name": "@asterpay/attest-sdk",
+  "version": "0.1.0",
+  "description": "EU AI Act compliance toolkit for TypeScript — scanner, risk classification, docs, audit logging.",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run"
+  },
+  "keywords": [
+    "eu-ai-act",
+    "compliance",
+    "ai",
+    "gdpr",
+    "audit",
+    "typescript"
+  ],
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/AsterPay/attest"
+  },
+  "homepage": "https://github.com/AsterPay/attest",
+  "dependencies": {
+    "typescript": "^5.7.3"
+  },
+  "devDependencies": {
+    "@types/node": "^20.11.16",
+    "vitest": "^3.0.5"
+  },
+  "engines": {
+    "node": ">=18.0.0"
+  }
+}