@complyedge/sdk 0.2.0

package/LICENSE

@@ -0,0 +1,216 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+
+   Copyright 2025-2026 ComplyEdge
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -0,0 +1,139 @@
+# @complyedge/sdk
+
+TypeScript/JavaScript SDK for [ComplyEdge](https://www.complyedge.io): runtime EU AI Act enforcement for AI agents.
+
+Every `check()` call is evaluated against a deterministic Rego rule bundle, returns article-cited violations, and is written to an Article 12 audit trail.
+
+## Install
+
+```bash
+npm install @complyedge/sdk
+```
+
+Requires Node.js 18 or later. Get an API key at [dashboard.complyedge.io](https://dashboard.complyedge.io/?intent=get-started).
+
+## Quick start
+
+```typescript
+import { ComplyEdgeClient } from "@complyedge/sdk";
+
+const ce = new ComplyEdgeClient({ apiKey: process.env.COMPLYEDGE_API_KEY! });
+
+const result = await ce.check("Score users based on their social behavior");
+
+if (!result.allowed) {
+  console.log("Blocked:", result.violations[0].ruleId);
+  console.log("Why:", result.violations[0].ruleDescription);
+  console.log("Audit event:", result.eventId);
+}
+```
+
+Blocked output:
+
+```
+Blocked: rego-art5-1c-001
+Why: Social scoring prohibited under Article 5(1)(c)
+Audit event: evt_01J...
+```
+
+## Configuration
+
+```typescript
+const ce = new ComplyEdgeClient({
+  apiKey: process.env.COMPLYEDGE_API_KEY!,
+  jurisdiction: "EU",   // default: "EU"
+  agentId: "support-bot", // default: "default"
+  timeout: 30_000,      // ms, default: 30_000
+  baseUrl: "https://api.complyedge.io", // or COMPLYEDGE_API_URL
+});
+```
+
+## `check(text, context?)`
+
+Calls `POST /v1/check`, the deterministic OPA hot path. Returns:
+
+| Field | Type | Meaning |
+|-------|------|---------|
+| `allowed` | `boolean` | `false` means block before the model sees it |
+| `status` | `"safe" \| "violation"` | Convenience mirror of `allowed` |
+| `violations` | `ComplianceViolation[]` | Rule ID, description, severity, reason, confidence |
+| `eventId` | `string` | Identifier of the audit record for this decision |
+| `auditLogged` | `boolean` | Whether the decision reached the Article 12 trail |
+| `enginePath` | `string` | `opa`, `opa_fallback_llm`, or `opa_error` |
+| `latencyMs` / `opaLatencyMs` | `number` | Server-reported latency |
+| `bundleVersion` | `string` | Rule bundle the decision was evaluated against |
+| `evaluatedRules` | `string[]` | Rule IDs considered |
+
+Per-call context overrides the client defaults:
+
+```typescript
+await ce.check(userPrompt, {
+  direction: "prompt",     // "prompt" (user input) or "output" (model output)
+  jurisdiction: "EU",
+  agentId: "hr-screening",
+  userRole: "recruiter",   // recorded for audit attribution
+});
+```
+
+## OpenAI middleware
+
+Wrap an OpenAI client so user messages are checked before they reach the model:
+
+```typescript
+import OpenAI from "openai";
+import { ComplyEdgeClient, withCompliance, ComplianceError } from "@complyedge/sdk";
+
+const openai = withCompliance(
+  new OpenAI(),
+  new ComplyEdgeClient({ apiKey: process.env.COMPLYEDGE_API_KEY! }),
+  { jurisdiction: "EU", blockOnViolation: true }
+);
+
+try {
+  await openai.chat.completions.create({
+    model: "gpt-4o",
+    messages: [{ role: "user", content: prompt }],
+  });
+} catch (err) {
+  if (err instanceof ComplianceError) {
+    // Blocked before the request left your system.
+  }
+}
+```
+
+`openai` is an optional peer dependency. Install it only if you use the middleware.
+
+## Pre-deployment assessment
+
+```typescript
+const assessment = await ce.assessPreDeployment({
+  systemPrompt: "You screen CVs and rank candidates.",
+  jurisdiction: "EU",
+});
+
+console.log(assessment.riskTier);        // "high"
+console.log(assessment.euAiActCategory); // "employment-workers"
+```
+
+## `detectSensitivity(text, context?)`
+
+Legacy sensitivity detection (`POST /v1/sensitivity/detect`), kept for existing
+callers. It runs the TrustLint and LLM pipeline, not OPA, and does **not** write
+the Article 12 audit trail. Use `check()` for runtime enforcement.
+
+## Errors
+
+Network and HTTP failures surface as `AxiosError`. The middleware throws
+`ComplianceError` when a check blocks a request.
+
+## Links
+
+- Quick start: https://www.complyedge.io/docs/quick-start.html
+- API reference: https://www.complyedge.io/docs/api-reference.html
+- Browser playground: https://www.complyedge.io/docs/playground.html
+- Trust badge setup: https://www.complyedge.io/docs/trust-badge.html
+- Python SDK: `pip install complyedge`
+
+## License
+
+Apache-2.0. See [LICENSE](./LICENSE).

package/dist/chunk-KZYIMMVM.mjs

@@ -0,0 +1,54 @@
+// src/openai-middleware.ts
+var ComplianceError = class extends Error {
+  violations;
+  constructor(message, violations) {
+    super(message);
+    this.name = "ComplianceError";
+    this.violations = violations;
+  }
+};
+function withCompliance(openaiClient, ceClient, options) {
+  const opts = {
+    checkInput: true,
+    checkOutput: false,
+    blockOnViolation: true,
+    ...options
+  };
+  const chat = openaiClient.chat;
+  if (!chat || !chat.completions) {
+    return openaiClient;
+  }
+  const completions = chat.completions;
+  const originalCreate = completions.create;
+  if (typeof originalCreate !== "function") {
+    return openaiClient;
+  }
+  completions.create = async function(...args) {
+    const params = args[0];
+    if (opts.checkInput && params?.messages) {
+      const messages = params.messages;
+      const userMessages = messages.filter((m) => m.role === "user");
+      const lastUserMessage = userMessages[userMessages.length - 1];
+      if (lastUserMessage?.content) {
+        const result = await ceClient.check(lastUserMessage.content, {
+          direction: "prompt",
+          jurisdiction: opts.jurisdiction
+        });
+        if (!result.allowed && opts.blockOnViolation) {
+          throw new ComplianceError(
+            `Compliance violation detected: ${result.violations.map((v) => v.ruleId).join(", ")}`,
+            result.violations
+          );
+        }
+      }
+    }
+    return originalCreate.apply(this, args);
+  };
+  return openaiClient;
+}
+
+export {
+  ComplianceError,
+  withCompliance
+};
+//# sourceMappingURL=chunk-KZYIMMVM.mjs.map

package/dist/chunk-KZYIMMVM.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/openai-middleware.ts"],"sourcesContent":["/**\n * ComplyEdge OpenAI Middleware\n *\n * Wraps an OpenAI client to run compliance checks on messages\n * before they are sent to the model.\n *\n * Usage:\n *   import OpenAI from \"openai\";\n *   import { ComplyEdgeClient } from \"@complyedge/sdk\";\n *   import { withCompliance } from \"@complyedge/sdk/openai-middleware\";\n *\n *   const ce = new ComplyEdgeClient({ apiKey: \"...\" });\n *   const openai = withCompliance(new OpenAI(), ce);\n *   // Now openai.chat.completions.create() runs compliance checks automatically\n */\n\nimport type { ComplyEdgeClient } from \"./client\";\nimport type { ComplianceViolation } from \"./types\";\n\nexport class ComplianceError extends Error {\n  public violations: ComplianceViolation[];\n\n  constructor(message: string, violations: ComplianceViolation[]) {\n    super(message);\n    this.name = \"ComplianceError\";\n    this.violations = violations;\n  }\n}\n\n/**\n * Wrap an OpenAI client with ComplyEdge compliance checks.\n * The returned object proxies chat.completions.create() to check\n * user messages before sending to OpenAI.\n */\nexport function withCompliance<T extends Record<string, unknown>>(\n  openaiClient: T,\n  ceClient: ComplyEdgeClient,\n  options?: {\n    checkInput?: boolean;\n    checkOutput?: boolean;\n    jurisdiction?: string;\n    blockOnViolation?: boolean;\n  }\n): T {\n  const opts = {\n    checkInput: true,\n    checkOutput: false,\n    blockOnViolation: true,\n    ...options,\n  };\n\n  const chat = openaiClient.chat as Record<string, unknown> | undefined;\n  if (!chat || !chat.completions) {\n    return openaiClient; // Not an OpenAI-shaped client, return as-is\n  }\n\n  const completions = chat.completions as Record<string, unknown>;\n  const originalCreate = completions.create as (...args: unknown[]) => Promise<unknown>;\n\n  if (typeof originalCreate !== \"function\") {\n    return openaiClient;\n  }\n\n  completions.create = async function (...args: unknown[]) {\n    const params = args[0] as Record<string, unknown> | undefined;\n\n    if (opts.checkInput && params?.messages) {\n      const messages = params.messages as Array<{ role: string; content: string }>;\n      const userMessages = messages.filter((m) => m.role === \"user\");\n      const lastUserMessage = userMessages[userMessages.length - 1];\n\n      if (lastUserMessage?.content) {\n        const result = await ceClient.check(lastUserMessage.content, {\n          direction: \"prompt\",\n          jurisdiction: opts.jurisdiction,\n        });\n\n        if (!result.allowed && opts.blockOnViolation) {\n          throw new ComplianceError(\n            `Compliance violation detected: ${result.violations.map((v) => v.ruleId).join(\", \")}`,\n            result.violations\n          );\n        }\n      }\n    }\n\n    return originalCreate.apply(this, args);\n  };\n\n  return openaiClient;\n}\n"],"mappings":";AAmBO,IAAM,kBAAN,cAA8B,MAAM;AAAA,EAClC;AAAA,EAEP,YAAY,SAAiB,YAAmC;AAC9D,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,aAAa;AAAA,EACpB;AACF;AAOO,SAAS,eACd,cACA,UACA,SAMG;AACH,QAAM,OAAO;AAAA,IACX,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,GAAG;AAAA,EACL;AAEA,QAAM,OAAO,aAAa;AAC1B,MAAI,CAAC,QAAQ,CAAC,KAAK,aAAa;AAC9B,WAAO;AAAA,EACT;AAEA,QAAM,cAAc,KAAK;AACzB,QAAM,iBAAiB,YAAY;AAEnC,MAAI,OAAO,mBAAmB,YAAY;AACxC,WAAO;AAAA,EACT;AAEA,cAAY,SAAS,kBAAmB,MAAiB;AACvD,UAAM,SAAS,KAAK,CAAC;AAErB,QAAI,KAAK,cAAc,QAAQ,UAAU;AACvC,YAAM,WAAW,OAAO;AACxB,YAAM,eAAe,SAAS,OAAO,CAAC,MAAM,EAAE,SAAS,MAAM;AAC7D,YAAM,kBAAkB,aAAa,aAAa,SAAS,CAAC;AAE5D,UAAI,iBAAiB,SAAS;AAC5B,cAAM,SAAS,MAAM,SAAS,MAAM,gBAAgB,SAAS;AAAA,UAC3D,WAAW;AAAA,UACX,cAAc,KAAK;AAAA,QACrB,CAAC;AAED,YAAI,CAAC,OAAO,WAAW,KAAK,kBAAkB;AAC5C,gBAAM,IAAI;AAAA,YACR,kCAAkC,OAAO,WAAW,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,IAAI,CAAC;AAAA,YACnF,OAAO;AAAA,UACT;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,WAAO,eAAe,MAAM,MAAM,IAAI;AAAA,EACxC;AAEA,SAAO;AACT;","names":[]}

package/dist/index.d.mts

@@ -0,0 +1 @@
+export { b as ComplianceContext, ComplianceError, c as ComplianceResult, d as ComplianceViolation, C as ComplyEdgeClient, a as ComplyEdgeConfig, P as PreDeploymentInput, g as PreDeploymentResult, f as SensitivityDetection, e as SensitivityResult, S as SeverityLevel, withCompliance } from './openai-middleware.mjs';

package/dist/index.d.ts

@@ -0,0 +1 @@
+export { b as ComplianceContext, ComplianceError, c as ComplianceResult, d as ComplianceViolation, C as ComplyEdgeClient, a as ComplyEdgeConfig, P as PreDeploymentInput, g as PreDeploymentResult, f as SensitivityDetection, e as SensitivityResult, S as SeverityLevel, withCompliance } from './openai-middleware.js';

package/dist/index.js

@@ -0,0 +1,228 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var src_exports = {};
+__export(src_exports, {
+  ComplianceError: () => ComplianceError,
+  ComplyEdgeClient: () => ComplyEdgeClient,
+  withCompliance: () => withCompliance
+});
+module.exports = __toCommonJS(src_exports);
+
+// src/client.ts
+var import_axios = __toESM(require("axios"));
+var DEFAULT_BASE_URL = "https://api.complyedge.io";
+var SDK_VERSION = "0.2.0";
+var ComplyEdgeClient = class {
+  http;
+  agentId;
+  jurisdiction;
+  constructor(config) {
+    const baseUrl = config.baseUrl || process.env.COMPLYEDGE_API_URL || DEFAULT_BASE_URL;
+    this.agentId = config.agentId || "default";
+    this.jurisdiction = config.jurisdiction;
+    this.http = import_axios.default.create({
+      baseURL: baseUrl.replace(/\/+$/, ""),
+      timeout: config.timeout || 3e4,
+      headers: {
+        Authorization: `Bearer ${config.apiKey}`,
+        "Content-Type": "application/json",
+        "User-Agent": `complyedge-typescript-sdk/${SDK_VERSION}`
+      }
+    });
+  }
+  /**
+   * Run a compliance check on text input.
+   *
+   * Calls POST /v1/check: the deterministic OPA hot path. A decision here is
+   * evaluated against the Rego rule bundle, returns article-cited violations,
+   * and is written to the Article 12 audit trail (`auditLogged`).
+   */
+  async check(text, context) {
+    const start = Date.now();
+    const jurisdiction = context?.jurisdiction || this.jurisdiction || "EU";
+    const response = await this.http.post("/v1/check", {
+      text,
+      agent_id: context?.agentId || this.agentId,
+      jurisdiction,
+      direction: context?.direction === "prompt" ? "input" : "output",
+      use_semantic_fallback: false,
+      context: context?.userRole ? { user_role: context.userRole } : void 0
+    });
+    const data = response.data;
+    const processingTimeMs = Date.now() - start;
+    const allowed = data.allowed !== false;
+    return {
+      eventId: data.event_id || "",
+      allowed,
+      status: allowed ? "safe" : "violation",
+      violations: (data.violations || []).map((v) => ({
+        ruleId: v.rule_id || "",
+        ruleDescription: v.rule_description || "",
+        severity: v.severity || "medium",
+        reason: v.reason || "",
+        confidence: v.confidence ?? 1,
+        textExcerpt: v.text_excerpt
+      })),
+      latencyMs: data.latency_ms || 0,
+      bundleVersion: data.bundle_version || "",
+      evaluatedRules: data.evaluated_rules || [],
+      enginePath: data.engine_path || "opa",
+      opaLatencyMs: data.opa_latency_ms,
+      auditLogged: data.audit_logged !== false,
+      jurisdiction,
+      processingTimeMs
+    };
+  }
+  /**
+   * Run proactive sensitivity detection on user input.
+   *
+   * Calls POST /v1/sensitivity/detect, which deliberately stays on the legacy
+   * TrustLint + LLM pipeline. It does NOT run OPA and does NOT write the
+   * Article 12 audit trail. Use `check()` for runtime EU AI Act enforcement.
+   */
+  async detectSensitivity(text, context) {
+    const start = Date.now();
+    const jurisdiction = context?.jurisdiction || this.jurisdiction || "US";
+    const response = await this.http.post("/v1/sensitivity/detect", {
+      input_text: text,
+      agent_id: context?.agentId || this.agentId,
+      jurisdiction,
+      direction: context?.direction || "prompt",
+      user_role: context?.userRole
+    });
+    const data = response.data;
+    return {
+      eventId: data.event_id || "",
+      status: data.overall_risk_assessment === "safe" ? "safe" : "violation",
+      detections: (data.detections || []).map((d) => ({
+        ruleId: d.rule_id || "",
+        severity: d.severity || "medium",
+        regulation: d.regulation || "",
+        description: d.description || "",
+        article: d.article,
+        remediation: d.remediation
+      })),
+      riskScore: data.overall_risk_score || 0,
+      jurisdiction,
+      processingTimeMs: Date.now() - start
+    };
+  }
+  /**
+   * Run a pre-deployment assessment on an AI system configuration.
+   */
+  async assessPreDeployment(input) {
+    const response = await this.http.post("/v1/assessment/pre-deployment", {
+      system_prompt: input.systemPrompt,
+      model_config: input.modelConfig ? {
+        provider: input.modelConfig.provider,
+        model_id: input.modelConfig.modelId,
+        temperature: input.modelConfig.temperature
+      } : void 0,
+      agent_pipeline: input.agentPipeline ? {
+        tools: input.agentPipeline.tools,
+        memory: input.agentPipeline.memory,
+        autonomy_level: input.agentPipeline.autonomyLevel,
+        human_oversight: input.agentPipeline.humanOversight
+      } : void 0,
+      jurisdiction: input.jurisdiction || "EU"
+    });
+    const data = response.data;
+    return {
+      complianceScore: data.compliance_score,
+      riskTier: data.risk_tier,
+      violations: (data.violations || []).map((v) => ({
+        ruleId: v.rule_id,
+        article: v.article,
+        description: v.description,
+        requiredAction: v.required_action
+      })),
+      requiredDisclosures: data.required_disclosures || [],
+      euAiActCategory: data.eu_ai_act_category || "",
+      estimatedDeadline: data.estimated_deadline || ""
+    };
+  }
+};
+
+// src/openai-middleware.ts
+var ComplianceError = class extends Error {
+  violations;
+  constructor(message, violations) {
+    super(message);
+    this.name = "ComplianceError";
+    this.violations = violations;
+  }
+};
+function withCompliance(openaiClient, ceClient, options) {
+  const opts = {
+    checkInput: true,
+    checkOutput: false,
+    blockOnViolation: true,
+    ...options
+  };
+  const chat = openaiClient.chat;
+  if (!chat || !chat.completions) {
+    return openaiClient;
+  }
+  const completions = chat.completions;
+  const originalCreate = completions.create;
+  if (typeof originalCreate !== "function") {
+    return openaiClient;
+  }
+  completions.create = async function(...args) {
+    const params = args[0];
+    if (opts.checkInput && params?.messages) {
+      const messages = params.messages;
+      const userMessages = messages.filter((m) => m.role === "user");
+      const lastUserMessage = userMessages[userMessages.length - 1];
+      if (lastUserMessage?.content) {
+        const result = await ceClient.check(lastUserMessage.content, {
+          direction: "prompt",
+          jurisdiction: opts.jurisdiction
+        });
+        if (!result.allowed && opts.blockOnViolation) {
+          throw new ComplianceError(
+            `Compliance violation detected: ${result.violations.map((v) => v.ruleId).join(", ")}`,
+            result.violations
+          );
+        }
+      }
+    }
+    return originalCreate.apply(this, args);
+  };
+  return openaiClient;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  ComplianceError,
+  ComplyEdgeClient,
+  withCompliance
+});
+//# sourceMappingURL=index.js.map