@complyedge/sdk 0.2.0 → 0.2.2

package/CHANGELOG.md

@@ -0,0 +1,55 @@
+# Changelog
+
+All notable changes to `@complyedge/sdk` are documented here.
+
+The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and
+this package follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+**This record begins at 0.2.2.** Earlier releases shipped before the changelog
+existed; 0.2.1 is reconstructed from its commits, and anything not evidenced
+there is left out rather than guessed at.
+
+The Python SDK (`complyedge` on PyPI) is versioned independently. Version
+numbers are deliberately not kept level between the two — they are separate
+implementations with different capability surfaces, so matching numbers would
+imply a parity that does not exist.
+
+## [0.2.2] - 2026-08-20
+
+### Changed
+- Releases now publish through npm Trusted Publishing (OIDC). Each publish uses
+  a short-lived, workflow-scoped credential instead of a long-lived token, and
+  the token has been removed from the release workflow rather than left in place
+  as a fallback.
+
+### Added
+- This changelog.
+
+### Note
+- Provenance attestations are still not generated. npm produces them only when
+  publishing from a public repository, and the release workflow lives in a
+  private one. No package page claims provenance.
+
+## [0.2.1] - 2026-08-16
+
+### Added
+- `repository` field, which the package had never carried.
+- `Limitations and honest scope` section in the README — the SDK calls the
+  hosted API and is not an offline engine, a rule finding is technical evidence
+  rather than legal advice, and the OpenAI middleware is not a security sandbox.
+- Explicit note that the package works in both ESM and CommonJS projects.
+- Cross-links to `@complyedge/mcp`, `trustlint`, and the PyPI packages.
+
+### Changed
+- Description rewritten to name what the SDK actually does: OPA/Rego policy
+  checks, Article 12 audit trails, risk assessment, OpenAI middleware.
+- Keywords: 5 → 16, replacing generic terms with the ones a compliance buyer
+  searches. `opa` and `rego` are kept here because this package does call the
+  OPA hot path — they were removed from `trustlint`, which does not.
+
+## 0.2.0 and earlier
+
+Released before this changelog existed. See the repository history.
+
+[0.2.2]: https://www.npmjs.com/package/@complyedge/sdk/v/0.2.2
+[0.2.1]: https://www.npmjs.com/package/@complyedge/sdk/v/0.2.1

package/README.md

@@ -4,6 +4,10 @@ TypeScript/JavaScript SDK for [ComplyEdge](https://www.complyedge.io): runtime E
 
 Every `check()` call is evaluated against a deterministic Rego rule bundle, returns article-cited violations, and is written to an Article 12 audit trail.
 
+![npm version](https://img.shields.io/npm/v/%40complyedge%2Fsdk)
+![npm downloads](https://img.shields.io/npm/dw/%40complyedge%2Fsdk)
+![license](https://img.shields.io/npm/l/%40complyedge%2Fsdk)
+
 ## Install
 
 ```bash
@@ -12,6 +16,19 @@ npm install @complyedge/sdk
 
 Requires Node.js 18 or later. Get an API key at [dashboard.complyedge.io](https://dashboard.complyedge.io/?intent=get-started).
 
+The SDK works in both ESM and CommonJS projects; no bundler-specific setup is required.
+
+## Package map
+
+- [`@complyedge/mcp`](https://www.npmjs.com/package/@complyedge/mcp) runs the local, offline TrustLint MCP tools with `npx`.
+- [`trustlint`](https://www.npmjs.com/package/trustlint) is the local Node.js CLI for offline rule checks.
+- [`complyedge` on PyPI](https://pypi.org/project/complyedge/) is the Python SDK with the same enforcement API.
+- [Documentation](https://www.complyedge.io/docs) covers the hosted API; the [trust portal](https://trust.complyedge.io) covers security and reliability information.
+
+## Version policy
+
+The TypeScript SDK and Python `complyedge` package have independent semantic versions. A version number does not imply feature parity across languages; each release documents and tests its own supported API surface.
+
 ## Quick start
 
 ```typescript
@@ -126,6 +143,16 @@ the Article 12 audit trail. Use `check()` for runtime enforcement.
 Network and HTTP failures surface as `AxiosError`. The middleware throws
 `ComplianceError` when a check blocks a request.
 
+## Limitations and honest scope
+
+- This SDK calls the hosted ComplyEdge API; it is not an offline rules engine.
+  Use `trustlint` or `@complyedge/mcp` when a local-only check is required.
+- A rule finding is technical compliance evidence, not legal advice or a legal
+  determination of an AI system's full regulatory classification.
+- The OpenAI middleware checks the request path shown above. It is not a
+  general-purpose security sandbox and does not automatically govern other
+  model providers or application code.
+
 ## Links
 
 - Quick start: https://www.complyedge.io/docs/quick-start.html

package/dist/chunk-X7L22AQP.mjs

@@ -0,0 +1,88 @@
+// src/openai-middleware.ts
+var ComplianceError = class extends Error {
+  violations;
+  constructor(message, violations) {
+    super(message);
+    this.name = "ComplianceError";
+    this.violations = violations;
+  }
+};
+function withCompliance(openaiClient, ceClient, options) {
+  const opts = {
+    checkInput: true,
+    checkOutput: false,
+    blockOnViolation: true,
+    ...options
+  };
+  const chat = openaiClient.chat;
+  if (!chat || !chat.completions) {
+    return openaiClient;
+  }
+  const completions = chat.completions;
+  const originalCreate = completions.create;
+  if (typeof originalCreate !== "function") {
+    return openaiClient;
+  }
+  completions.create = async function(...args) {
+    const params = args[0];
+    if (opts.checkInput && params?.messages) {
+      const messages = params.messages;
+      for (const message of messages) {
+        if (message.role !== "user") continue;
+        for (const text of extractText(message.content)) {
+          const result = await ceClient.check(text, {
+            direction: "prompt",
+            jurisdiction: opts.jurisdiction
+          });
+          if (!result.allowed && opts.blockOnViolation) {
+            throw new ComplianceError(
+              `Compliance violation detected: ${result.violations.map((v) => v.ruleId).join(", ")}`,
+              result.violations
+            );
+          }
+        }
+      }
+    }
+    const response = await originalCreate.apply(this, args);
+    if (opts.checkOutput) {
+      for (const text of extractCompletionText(response)) {
+        const result = await ceClient.check(text, {
+          direction: "output",
+          jurisdiction: opts.jurisdiction
+        });
+        if (!result.allowed && opts.blockOnViolation) {
+          throw new ComplianceError(
+            `Compliance violation in model output: ${result.violations.map((v) => v.ruleId).join(", ")}`,
+            result.violations
+          );
+        }
+      }
+    }
+    return response;
+  };
+  return openaiClient;
+}
+function extractText(content) {
+  if (typeof content === "string") {
+    return content.trim() ? [content] : [];
+  }
+  if (Array.isArray(content)) {
+    return content.map((part) => {
+      if (typeof part === "string") return part;
+      const p = part;
+      return p && typeof p.text === "string" ? p.text : "";
+    }).filter((t) => t.trim().length > 0);
+  }
+  return [];
+}
+function extractCompletionText(response) {
+  const r = response;
+  if (!r?.choices) return [];
+  return r.choices.flatMap((choice) => extractText(choice?.message?.content));
+}
+
+export {
+  ComplianceError,
+  withCompliance
+};
+//# sourceMappingURL=chunk-X7L22AQP.mjs.map

package/dist/chunk-X7L22AQP.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/openai-middleware.ts"],"sourcesContent":["/**\n * ComplyEdge OpenAI Middleware\n *\n * Wraps an OpenAI client to run compliance checks on messages\n * before they are sent to the model.\n *\n * Usage:\n *   import OpenAI from \"openai\";\n *   import { ComplyEdgeClient } from \"@complyedge/sdk\";\n *   import { withCompliance } from \"@complyedge/sdk/openai-middleware\";\n *\n *   const ce = new ComplyEdgeClient({ apiKey: \"...\" });\n *   const openai = withCompliance(new OpenAI(), ce);\n *   // Now openai.chat.completions.create() runs compliance checks automatically\n */\n\nimport type { ComplyEdgeClient } from \"./client\";\nimport type { ComplianceViolation } from \"./types\";\n\nexport class ComplianceError extends Error {\n  public violations: ComplianceViolation[];\n\n  constructor(message: string, violations: ComplianceViolation[]) {\n    super(message);\n    this.name = \"ComplianceError\";\n    this.violations = violations;\n  }\n}\n\n/**\n * Wrap an OpenAI client with ComplyEdge compliance checks.\n * The returned object proxies chat.completions.create() to check\n * user messages before sending to OpenAI.\n */\nexport function withCompliance<T extends Record<string, unknown>>(\n  openaiClient: T,\n  ceClient: ComplyEdgeClient,\n  options?: {\n    checkInput?: boolean;\n    checkOutput?: boolean;\n    jurisdiction?: string;\n    blockOnViolation?: boolean;\n  }\n): T {\n  const opts = {\n    checkInput: true,\n    checkOutput: false,\n    blockOnViolation: true,\n    ...options,\n  };\n\n  const chat = openaiClient.chat as Record<string, unknown> | undefined;\n  if (!chat || !chat.completions) {\n    return openaiClient; // Not an OpenAI-shaped client, return as-is\n  }\n\n  const completions = chat.completions as Record<string, unknown>;\n  const originalCreate = completions.create as (...args: unknown[]) => Promise<unknown>;\n\n  if (typeof originalCreate !== \"function\") {\n    return openaiClient;\n  }\n\n  completions.create = async function (...args: unknown[]) {\n    const params = args[0] as Record<string, unknown> | undefined;\n\n    if (opts.checkInput && params?.messages) {\n      const messages = params.messages as Array<{ role: string; content: unknown }>;\n      // Check EVERY user turn, not just the last one. A violation in an earlier\n      // message is still sent to the model verbatim, so checking only the tail\n      // left the majority of a multi-turn conversation unenforced.\n      for (const message of messages) {\n        if (message.role !== \"user\") continue;\n        for (const text of extractText(message.content)) {\n          const result = await ceClient.check(text, {\n            direction: \"prompt\",\n            jurisdiction: opts.jurisdiction,\n          });\n          if (!result.allowed && opts.blockOnViolation) {\n            throw new ComplianceError(\n              `Compliance violation detected: ${result.violations.map((v) => v.ruleId).join(\", \")}`,\n              result.violations\n            );\n          }\n        }\n      }\n    }\n\n    const response = await originalCreate.apply(this, args);\n\n    if (opts.checkOutput) {\n      // Previously declared in the options type and never read, so the README's\n      // \"runs compliance checks automatically\" was half true: inputs were\n      // checked, model output never was, silently.\n      for (const text of extractCompletionText(response)) {\n        const result = await ceClient.check(text, {\n          direction: \"output\",\n          jurisdiction: opts.jurisdiction,\n        });\n        if (!result.allowed && opts.blockOnViolation) {\n          throw new ComplianceError(\n            `Compliance violation in model output: ${result.violations.map((v) => v.ruleId).join(\", \")}`,\n            result.violations\n          );\n        }\n      }\n    }\n\n    return response;\n  };\n\n  return openaiClient;\n}\n\n/**\n * Pull checkable strings out of a message `content` field.\n *\n * OpenAI accepts either a plain string or an array of typed content parts.\n * The array form was previously passed to the API as a non-string and 422'd,\n * so multimodal callers could not use the middleware at all.\n */\nfunction extractText(content: unknown): string[] {\n  if (typeof content === \"string\") {\n    return content.trim() ? [content] : [];\n  }\n  if (Array.isArray(content)) {\n    return content\n      .map((part) => {\n        if (typeof part === \"string\") return part;\n        const p = part as Record<string, unknown> | null;\n        return p && typeof p.text === \"string\" ? p.text : \"\";\n      })\n      .filter((t) => t.trim().length > 0);\n  }\n  return [];\n}\n\n/** Pull assistant message text out of a chat completion response. */\nfunction extractCompletionText(response: unknown): string[] {\n  const r = response as { choices?: Array<{ message?: { content?: unknown } }> } | null;\n  if (!r?.choices) return [];\n  return r.choices.flatMap((choice) => extractText(choice?.message?.content));\n}\n"],"mappings":";AAmBO,IAAM,kBAAN,cAA8B,MAAM;AAAA,EAClC;AAAA,EAEP,YAAY,SAAiB,YAAmC;AAC9D,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,aAAa;AAAA,EACpB;AACF;AAOO,SAAS,eACd,cACA,UACA,SAMG;AACH,QAAM,OAAO;AAAA,IACX,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,GAAG;AAAA,EACL;AAEA,QAAM,OAAO,aAAa;AAC1B,MAAI,CAAC,QAAQ,CAAC,KAAK,aAAa;AAC9B,WAAO;AAAA,EACT;AAEA,QAAM,cAAc,KAAK;AACzB,QAAM,iBAAiB,YAAY;AAEnC,MAAI,OAAO,mBAAmB,YAAY;AACxC,WAAO;AAAA,EACT;AAEA,cAAY,SAAS,kBAAmB,MAAiB;AACvD,UAAM,SAAS,KAAK,CAAC;AAErB,QAAI,KAAK,cAAc,QAAQ,UAAU;AACvC,YAAM,WAAW,OAAO;AAIxB,iBAAW,WAAW,UAAU;AAC9B,YAAI,QAAQ,SAAS,OAAQ;AAC7B,mBAAW,QAAQ,YAAY,QAAQ,OAAO,GAAG;AAC/C,gBAAM,SAAS,MAAM,SAAS,MAAM,MAAM;AAAA,YACxC,WAAW;AAAA,YACX,cAAc,KAAK;AAAA,UACrB,CAAC;AACD,cAAI,CAAC,OAAO,WAAW,KAAK,kBAAkB;AAC5C,kBAAM,IAAI;AAAA,cACR,kCAAkC,OAAO,WAAW,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,IAAI,CAAC;AAAA,cACnF,OAAO;AAAA,YACT;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,UAAM,WAAW,MAAM,eAAe,MAAM,MAAM,IAAI;AAEtD,QAAI,KAAK,aAAa;AAIpB,iBAAW,QAAQ,sBAAsB,QAAQ,GAAG;AAClD,cAAM,SAAS,MAAM,SAAS,MAAM,MAAM;AAAA,UACxC,WAAW;AAAA,UACX,cAAc,KAAK;AAAA,QACrB,CAAC;AACD,YAAI,CAAC,OAAO,WAAW,KAAK,kBAAkB;AAC5C,gBAAM,IAAI;AAAA,YACR,yCAAyC,OAAO,WAAW,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,IAAI,CAAC;AAAA,YAC1F,OAAO;AAAA,UACT;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAEA,SAAO;AACT;AASA,SAAS,YAAY,SAA4B;AAC/C,MAAI,OAAO,YAAY,UAAU;AAC/B,WAAO,QAAQ,KAAK,IAAI,CAAC,OAAO,IAAI,CAAC;AAAA,EACvC;AACA,MAAI,MAAM,QAAQ,OAAO,GAAG;AAC1B,WAAO,QACJ,IAAI,CAAC,SAAS;AACb,UAAI,OAAO,SAAS,SAAU,QAAO;AACrC,YAAM,IAAI;AACV,aAAO,KAAK,OAAO,EAAE,SAAS,WAAW,EAAE,OAAO;AAAA,IACpD,CAAC,EACA,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,CAAC;AAAA,EACtC;AACA,SAAO,CAAC;AACV;AAGA,SAAS,sBAAsB,UAA6B;AAC1D,QAAM,IAAI;AACV,MAAI,CAAC,GAAG,QAAS,QAAO,CAAC;AACzB,SAAO,EAAE,QAAQ,QAAQ,CAAC,WAAW,YAAY,QAAQ,SAAS,OAAO,CAAC;AAC5E;","names":[]}

package/dist/index.js

@@ -72,7 +72,12 @@ var ComplyEdgeClient = class {
       text,
       agent_id: context?.agentId || this.agentId,
       jurisdiction,
-      direction: context?.direction === "prompt" ? "input" : "output",
+      // Pass the caller's direction through untouched. This previously mapped
+      // "prompt" to "input", a value the API's DirectionType enum does not
+      // accept ("prompt" | "output"), so every input check 422'd and the
+      // wrapped call threw. The SDK's own ComplianceContext type has always
+      // declared the correct union; only this line disagreed with it.
+      direction: context?.direction ?? "output",
       use_semantic_fallback: false,
       context: context?.userRole ? { user_role: context.userRole } : void 0
     });
@@ -97,6 +102,8 @@ var ComplyEdgeClient = class {
       enginePath: data.engine_path || "opa",
       opaLatencyMs: data.opa_latency_ms,
       auditLogged: data.audit_logged !== false,
+      textHash: data.text_hash || "",
+      timestamp: data.timestamp,
       jurisdiction,
       processingTimeMs
     };
@@ -110,7 +117,7 @@ var ComplyEdgeClient = class {
    */
   async detectSensitivity(text, context) {
     const start = Date.now();
-    const jurisdiction = context?.jurisdiction || this.jurisdiction || "US";
+    const jurisdiction = context?.jurisdiction || this.jurisdiction || "EU";
     const response = await this.http.post("/v1/sensitivity/detect", {
       input_text: text,
       agent_id: context?.agentId || this.agentId,
@@ -200,25 +207,59 @@ function withCompliance(openaiClient, ceClient, options) {
     const params = args[0];
     if (opts.checkInput && params?.messages) {
       const messages = params.messages;
-      const userMessages = messages.filter((m) => m.role === "user");
-      const lastUserMessage = userMessages[userMessages.length - 1];
-      if (lastUserMessage?.content) {
-        const result = await ceClient.check(lastUserMessage.content, {
-          direction: "prompt",
+      for (const message of messages) {
+        if (message.role !== "user") continue;
+        for (const text of extractText(message.content)) {
+          const result = await ceClient.check(text, {
+            direction: "prompt",
+            jurisdiction: opts.jurisdiction
+          });
+          if (!result.allowed && opts.blockOnViolation) {
+            throw new ComplianceError(
+              `Compliance violation detected: ${result.violations.map((v) => v.ruleId).join(", ")}`,
+              result.violations
+            );
+          }
+        }
+      }
+    }
+    const response = await originalCreate.apply(this, args);
+    if (opts.checkOutput) {
+      for (const text of extractCompletionText(response)) {
+        const result = await ceClient.check(text, {
+          direction: "output",
           jurisdiction: opts.jurisdiction
         });
         if (!result.allowed && opts.blockOnViolation) {
           throw new ComplianceError(
-            `Compliance violation detected: ${result.violations.map((v) => v.ruleId).join(", ")}`,
+            `Compliance violation in model output: ${result.violations.map((v) => v.ruleId).join(", ")}`,
             result.violations
           );
         }
       }
     }
-    return originalCreate.apply(this, args);
+    return response;
   };
   return openaiClient;
 }
+function extractText(content) {
+  if (typeof content === "string") {
+    return content.trim() ? [content] : [];
+  }
+  if (Array.isArray(content)) {
+    return content.map((part) => {
+      if (typeof part === "string") return part;
+      const p = part;
+      return p && typeof p.text === "string" ? p.text : "";
+    }).filter((t) => t.trim().length > 0);
+  }
+  return [];
+}
+function extractCompletionText(response) {
+  const r = response;
+  if (!r?.choices) return [];
+  return r.choices.flatMap((choice) => extractText(choice?.message?.content));
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   ComplianceError,

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts","../src/client.ts","../src/openai-middleware.ts"],"sourcesContent":["/**\n * ComplyEdge TypeScript SDK\n *\n * Runtime EU AI Act enforcement for AI agents.\n *\n * @example\n * ```typescript\n * import { ComplyEdgeClient } from \"@complyedge/sdk\";\n *\n * const ce = new ComplyEdgeClient({ apiKey: process.env.COMPLYEDGE_API_KEY! });\n * const result = await ce.check(\"Your AI prompt here\");\n *\n * if (result.status === \"violation\") {\n *   console.log(\"Blocked:\", result.violations);\n * }\n * ```\n */\n\nexport { ComplyEdgeClient } from \"./client\";\nexport { withCompliance, ComplianceError } from \"./openai-middleware\";\nexport type {\n  ComplyEdgeConfig,\n  ComplianceContext,\n  ComplianceResult,\n  ComplianceViolation,\n  SeverityLevel,\n  SensitivityResult,\n  SensitivityDetection,\n  PreDeploymentInput,\n  PreDeploymentResult,\n} from \"./types\";\n","/**\n * ComplyEdge TypeScript SDK — Client\n */\n\nimport axios, { AxiosInstance } from \"axios\";\nimport type {\n  ComplyEdgeConfig,\n  ComplianceContext,\n  ComplianceResult,\n  ComplianceViolation,\n  SensitivityDetection,\n  SensitivityResult,\n  PreDeploymentInput,\n  PreDeploymentResult,\n} from \"./types\";\n\nconst DEFAULT_BASE_URL = \"https://api.complyedge.io\";\nconst SDK_VERSION = \"0.2.0\";\n\nexport class ComplyEdgeClient {\n  private http: AxiosInstance;\n  private agentId: string;\n  private jurisdiction?: string;\n\n  constructor(config: ComplyEdgeConfig) {\n    const baseUrl = config.baseUrl || process.env.COMPLYEDGE_API_URL || DEFAULT_BASE_URL;\n\n    this.agentId = config.agentId || \"default\";\n    this.jurisdiction = config.jurisdiction;\n\n    this.http = axios.create({\n      baseURL: baseUrl.replace(/\\/+$/, \"\"),\n      timeout: config.timeout || 30_000,\n      headers: {\n        Authorization: `Bearer ${config.apiKey}`,\n        \"Content-Type\": \"application/json\",\n        \"User-Agent\": `complyedge-typescript-sdk/${SDK_VERSION}`,\n      },\n    });\n  }\n\n  /**\n   * Run a compliance check on text input.\n   *\n   * Calls POST /v1/check: the deterministic OPA hot path. A decision here is\n   * evaluated against the Rego rule bundle, returns article-cited violations,\n   * and is written to the Article 12 audit trail (`auditLogged`).\n   */\n  async check(text: string, context?: ComplianceContext): Promise<ComplianceResult> {\n    const start = Date.now();\n    const jurisdiction = context?.jurisdiction || this.jurisdiction || \"EU\";\n\n    const response = await this.http.post(\"/v1/check\", {\n      text,\n      agent_id: context?.agentId || this.agentId,\n      jurisdiction,\n      direction: context?.direction === \"prompt\" ? \"input\" : \"output\",\n      use_semantic_fallback: false,\n      context: context?.userRole ? { user_role: context.userRole } : undefined,\n    });\n\n    const data = response.data;\n    const processingTimeMs = Date.now() - start;\n    const allowed = data.allowed !== false;\n\n    return {\n      eventId: data.event_id || \"\",\n      allowed,\n      status: allowed ? \"safe\" : \"violation\",\n      violations: (data.violations || []).map((v: Record<string, unknown>) => ({\n        ruleId: (v.rule_id as string) || \"\",\n        ruleDescription: (v.rule_description as string) || \"\",\n        severity: (v.severity as ComplianceViolation[\"severity\"]) || \"medium\",\n        reason: (v.reason as string) || \"\",\n        confidence: (v.confidence as number) ?? 1.0,\n        textExcerpt: v.text_excerpt as string | undefined,\n      })),\n      latencyMs: data.latency_ms || 0,\n      bundleVersion: data.bundle_version || \"\",\n      evaluatedRules: data.evaluated_rules || [],\n      enginePath: data.engine_path || \"opa\",\n      opaLatencyMs: data.opa_latency_ms,\n      auditLogged: data.audit_logged !== false,\n      jurisdiction,\n      processingTimeMs,\n    };\n  }\n\n  /**\n   * Run proactive sensitivity detection on user input.\n   *\n   * Calls POST /v1/sensitivity/detect, which deliberately stays on the legacy\n   * TrustLint + LLM pipeline. It does NOT run OPA and does NOT write the\n   * Article 12 audit trail. Use `check()` for runtime EU AI Act enforcement.\n   */\n  async detectSensitivity(\n    text: string,\n    context?: ComplianceContext\n  ): Promise<SensitivityResult> {\n    const start = Date.now();\n    const jurisdiction = context?.jurisdiction || this.jurisdiction || \"US\";\n\n    const response = await this.http.post(\"/v1/sensitivity/detect\", {\n      input_text: text,\n      agent_id: context?.agentId || this.agentId,\n      jurisdiction,\n      direction: context?.direction || \"prompt\",\n      user_role: context?.userRole,\n    });\n\n    const data = response.data;\n\n    return {\n      eventId: data.event_id || \"\",\n      status: data.overall_risk_assessment === \"safe\" ? \"safe\" : \"violation\",\n      detections: (data.detections || []).map((d: Record<string, unknown>) => ({\n        ruleId: (d.rule_id as string) || \"\",\n        severity: (d.severity as SensitivityDetection[\"severity\"]) || \"medium\",\n        regulation: (d.regulation as string) || \"\",\n        description: (d.description as string) || \"\",\n        article: d.article as string | undefined,\n        remediation: d.remediation as string | undefined,\n      })),\n      riskScore: data.overall_risk_score || 0,\n      jurisdiction,\n      processingTimeMs: Date.now() - start,\n    };\n  }\n\n  /**\n   * Run a pre-deployment assessment on an AI system configuration.\n   */\n  async assessPreDeployment(input: PreDeploymentInput): Promise<PreDeploymentResult> {\n    const response = await this.http.post(\"/v1/assessment/pre-deployment\", {\n      system_prompt: input.systemPrompt,\n      model_config: input.modelConfig\n        ? {\n            provider: input.modelConfig.provider,\n            model_id: input.modelConfig.modelId,\n            temperature: input.modelConfig.temperature,\n          }\n        : undefined,\n      agent_pipeline: input.agentPipeline\n        ? {\n            tools: input.agentPipeline.tools,\n            memory: input.agentPipeline.memory,\n            autonomy_level: input.agentPipeline.autonomyLevel,\n            human_oversight: input.agentPipeline.humanOversight,\n          }\n        : undefined,\n      jurisdiction: input.jurisdiction || \"EU\",\n    });\n\n    const data = response.data;\n    return {\n      complianceScore: data.compliance_score,\n      riskTier: data.risk_tier,\n      violations: (data.violations || []).map((v: Record<string, unknown>) => ({\n        ruleId: v.rule_id as string,\n        article: v.article as string,\n        description: v.description as string,\n        requiredAction: v.required_action as string,\n      })),\n      requiredDisclosures: data.required_disclosures || [],\n      euAiActCategory: data.eu_ai_act_category || \"\",\n      estimatedDeadline: data.estimated_deadline || \"\",\n    };\n  }\n}\n","/**\n * ComplyEdge OpenAI Middleware\n *\n * Wraps an OpenAI client to run compliance checks on messages\n * before they are sent to the model.\n *\n * Usage:\n *   import OpenAI from \"openai\";\n *   import { ComplyEdgeClient } from \"@complyedge/sdk\";\n *   import { withCompliance } from \"@complyedge/sdk/openai-middleware\";\n *\n *   const ce = new ComplyEdgeClient({ apiKey: \"...\" });\n *   const openai = withCompliance(new OpenAI(), ce);\n *   // Now openai.chat.completions.create() runs compliance checks automatically\n */\n\nimport type { ComplyEdgeClient } from \"./client\";\nimport type { ComplianceViolation } from \"./types\";\n\nexport class ComplianceError extends Error {\n  public violations: ComplianceViolation[];\n\n  constructor(message: string, violations: ComplianceViolation[]) {\n    super(message);\n    this.name = \"ComplianceError\";\n    this.violations = violations;\n  }\n}\n\n/**\n * Wrap an OpenAI client with ComplyEdge compliance checks.\n * The returned object proxies chat.completions.create() to check\n * user messages before sending to OpenAI.\n */\nexport function withCompliance<T extends Record<string, unknown>>(\n  openaiClient: T,\n  ceClient: ComplyEdgeClient,\n  options?: {\n    checkInput?: boolean;\n    checkOutput?: boolean;\n    jurisdiction?: string;\n    blockOnViolation?: boolean;\n  }\n): T {\n  const opts = {\n    checkInput: true,\n    checkOutput: false,\n    blockOnViolation: true,\n    ...options,\n  };\n\n  const chat = openaiClient.chat as Record<string, unknown> | undefined;\n  if (!chat || !chat.completions) {\n    return openaiClient; // Not an OpenAI-shaped client, return as-is\n  }\n\n  const completions = chat.completions as Record<string, unknown>;\n  const originalCreate = completions.create as (...args: unknown[]) => Promise<unknown>;\n\n  if (typeof originalCreate !== \"function\") {\n    return openaiClient;\n  }\n\n  completions.create = async function (...args: unknown[]) {\n    const params = args[0] as Record<string, unknown> | undefined;\n\n    if (opts.checkInput && params?.messages) {\n      const messages = params.messages as Array<{ role: string; content: string }>;\n      const userMessages = messages.filter((m) => m.role === \"user\");\n      const lastUserMessage = userMessages[userMessages.length - 1];\n\n      if (lastUserMessage?.content) {\n        const result = await ceClient.check(lastUserMessage.content, {\n          direction: \"prompt\",\n          jurisdiction: opts.jurisdiction,\n        });\n\n        if (!result.allowed && opts.blockOnViolation) {\n          throw new ComplianceError(\n            `Compliance violation detected: ${result.violations.map((v) => v.ruleId).join(\", \")}`,\n            result.violations\n          );\n        }\n      }\n    }\n\n    return originalCreate.apply(this, args);\n  };\n\n  return openaiClient;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACIA,mBAAqC;AAYrC,IAAM,mBAAmB;AACzB,IAAM,cAAc;AAEb,IAAM,mBAAN,MAAuB;AAAA,EACpB;AAAA,EACA;AAAA,EACA;AAAA,EAER,YAAY,QAA0B;AACpC,UAAM,UAAU,OAAO,WAAW,QAAQ,IAAI,sBAAsB;AAEpE,SAAK,UAAU,OAAO,WAAW;AACjC,SAAK,eAAe,OAAO;AAE3B,SAAK,OAAO,aAAAA,QAAM,OAAO;AAAA,MACvB,SAAS,QAAQ,QAAQ,QAAQ,EAAE;AAAA,MACnC,SAAS,OAAO,WAAW;AAAA,MAC3B,SAAS;AAAA,QACP,eAAe,UAAU,OAAO,MAAM;AAAA,QACtC,gBAAgB;AAAA,QAChB,cAAc,6BAA6B,WAAW;AAAA,MACxD;AAAA,IACF,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,MAAM,MAAc,SAAwD;AAChF,UAAM,QAAQ,KAAK,IAAI;AACvB,UAAM,eAAe,SAAS,gBAAgB,KAAK,gBAAgB;AAEnE,UAAM,WAAW,MAAM,KAAK,KAAK,KAAK,aAAa;AAAA,MACjD;AAAA,MACA,UAAU,SAAS,WAAW,KAAK;AAAA,MACnC;AAAA,MACA,WAAW,SAAS,cAAc,WAAW,UAAU;AAAA,MACvD,uBAAuB;AAAA,MACvB,SAAS,SAAS,WAAW,EAAE,WAAW,QAAQ,SAAS,IAAI;AAAA,IACjE,CAAC;AAED,UAAM,OAAO,SAAS;AACtB,UAAM,mBAAmB,KAAK,IAAI,IAAI;AACtC,UAAM,UAAU,KAAK,YAAY;AAEjC,WAAO;AAAA,MACL,SAAS,KAAK,YAAY;AAAA,MAC1B;AAAA,MACA,QAAQ,UAAU,SAAS;AAAA,MAC3B,aAAa,KAAK,cAAc,CAAC,GAAG,IAAI,CAAC,OAAgC;AAAA,QACvE,QAAS,EAAE,WAAsB;AAAA,QACjC,iBAAkB,EAAE,oBAA+B;AAAA,QACnD,UAAW,EAAE,YAAgD;AAAA,QAC7D,QAAS,EAAE,UAAqB;AAAA,QAChC,YAAa,EAAE,cAAyB;AAAA,QACxC,aAAa,EAAE;AAAA,MACjB,EAAE;AAAA,MACF,WAAW,KAAK,cAAc;AAAA,MAC9B,eAAe,KAAK,kBAAkB;AAAA,MACtC,gBAAgB,KAAK,mBAAmB,CAAC;AAAA,MACzC,YAAY,KAAK,eAAe;AAAA,MAChC,cAAc,KAAK;AAAA,MACnB,aAAa,KAAK,iBAAiB;AAAA,MACnC;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,kBACJ,MACA,SAC4B;AAC5B,UAAM,QAAQ,KAAK,IAAI;AACvB,UAAM,eAAe,SAAS,gBAAgB,KAAK,gBAAgB;AAEnE,UAAM,WAAW,MAAM,KAAK,KAAK,KAAK,0BAA0B;AAAA,MAC9D,YAAY;AAAA,MACZ,UAAU,SAAS,WAAW,KAAK;AAAA,MACnC;AAAA,MACA,WAAW,SAAS,aAAa;AAAA,MACjC,WAAW,SAAS;AAAA,IACtB,CAAC;AAED,UAAM,OAAO,SAAS;AAEtB,WAAO;AAAA,MACL,SAAS,KAAK,YAAY;AAAA,MAC1B,QAAQ,KAAK,4BAA4B,SAAS,SAAS;AAAA,MAC3D,aAAa,KAAK,cAAc,CAAC,GAAG,IAAI,CAAC,OAAgC;AAAA,QACvE,QAAS,EAAE,WAAsB;AAAA,QACjC,UAAW,EAAE,YAAiD;AAAA,QAC9D,YAAa,EAAE,cAAyB;AAAA,QACxC,aAAc,EAAE,eAA0B;AAAA,QAC1C,SAAS,EAAE;AAAA,QACX,aAAa,EAAE;AAAA,MACjB,EAAE;AAAA,MACF,WAAW,KAAK,sBAAsB;AAAA,MACtC;AAAA,MACA,kBAAkB,KAAK,IAAI,IAAI;AAAA,IACjC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,oBAAoB,OAAyD;AACjF,UAAM,WAAW,MAAM,KAAK,KAAK,KAAK,iCAAiC;AAAA,MACrE,eAAe,MAAM;AAAA,MACrB,cAAc,MAAM,cAChB;AAAA,QACE,UAAU,MAAM,YAAY;AAAA,QAC5B,UAAU,MAAM,YAAY;AAAA,QAC5B,aAAa,MAAM,YAAY;AAAA,MACjC,IACA;AAAA,MACJ,gBAAgB,MAAM,gBAClB;AAAA,QACE,OAAO,MAAM,cAAc;AAAA,QAC3B,QAAQ,MAAM,cAAc;AAAA,QAC5B,gBAAgB,MAAM,cAAc;AAAA,QACpC,iBAAiB,MAAM,cAAc;AAAA,MACvC,IACA;AAAA,MACJ,cAAc,MAAM,gBAAgB;AAAA,IACtC,CAAC;AAED,UAAM,OAAO,SAAS;AACtB,WAAO;AAAA,MACL,iBAAiB,KAAK;AAAA,MACtB,UAAU,KAAK;AAAA,MACf,aAAa,KAAK,cAAc,CAAC,GAAG,IAAI,CAAC,OAAgC;AAAA,QACvE,QAAQ,EAAE;AAAA,QACV,SAAS,EAAE;AAAA,QACX,aAAa,EAAE;AAAA,QACf,gBAAgB,EAAE;AAAA,MACpB,EAAE;AAAA,MACF,qBAAqB,KAAK,wBAAwB,CAAC;AAAA,MACnD,iBAAiB,KAAK,sBAAsB;AAAA,MAC5C,mBAAmB,KAAK,sBAAsB;AAAA,IAChD;AAAA,EACF;AACF;;;ACrJO,IAAM,kBAAN,cAA8B,MAAM;AAAA,EAClC;AAAA,EAEP,YAAY,SAAiB,YAAmC;AAC9D,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,aAAa;AAAA,EACpB;AACF;AAOO,SAAS,eACd,cACA,UACA,SAMG;AACH,QAAM,OAAO;AAAA,IACX,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,GAAG;AAAA,EACL;AAEA,QAAM,OAAO,aAAa;AAC1B,MAAI,CAAC,QAAQ,CAAC,KAAK,aAAa;AAC9B,WAAO;AAAA,EACT;AAEA,QAAM,cAAc,KAAK;AACzB,QAAM,iBAAiB,YAAY;AAEnC,MAAI,OAAO,mBAAmB,YAAY;AACxC,WAAO;AAAA,EACT;AAEA,cAAY,SAAS,kBAAmB,MAAiB;AACvD,UAAM,SAAS,KAAK,CAAC;AAErB,QAAI,KAAK,cAAc,QAAQ,UAAU;AACvC,YAAM,WAAW,OAAO;AACxB,YAAM,eAAe,SAAS,OAAO,CAAC,MAAM,EAAE,SAAS,MAAM;AAC7D,YAAM,kBAAkB,aAAa,aAAa,SAAS,CAAC;AAE5D,UAAI,iBAAiB,SAAS;AAC5B,cAAM,SAAS,MAAM,SAAS,MAAM,gBAAgB,SAAS;AAAA,UAC3D,WAAW;AAAA,UACX,cAAc,KAAK;AAAA,QACrB,CAAC;AAED,YAAI,CAAC,OAAO,WAAW,KAAK,kBAAkB;AAC5C,gBAAM,IAAI;AAAA,YACR,kCAAkC,OAAO,WAAW,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,IAAI,CAAC;AAAA,YACnF,OAAO;AAAA,UACT;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,WAAO,eAAe,MAAM,MAAM,IAAI;AAAA,EACxC;AAEA,SAAO;AACT;","names":["axios"]}
+{"version":3,"sources":["../src/index.ts","../src/client.ts","../src/openai-middleware.ts"],"sourcesContent":["/**\n * ComplyEdge TypeScript SDK\n *\n * Runtime EU AI Act enforcement for AI agents.\n *\n * @example\n * ```typescript\n * import { ComplyEdgeClient } from \"@complyedge/sdk\";\n *\n * const ce = new ComplyEdgeClient({ apiKey: process.env.COMPLYEDGE_API_KEY! });\n * const result = await ce.check(\"Your AI prompt here\");\n *\n * if (result.status === \"violation\") {\n *   console.log(\"Blocked:\", result.violations);\n * }\n * ```\n */\n\nexport { ComplyEdgeClient } from \"./client\";\nexport { withCompliance, ComplianceError } from \"./openai-middleware\";\nexport type {\n  ComplyEdgeConfig,\n  ComplianceContext,\n  ComplianceResult,\n  ComplianceViolation,\n  SeverityLevel,\n  SensitivityResult,\n  SensitivityDetection,\n  PreDeploymentInput,\n  PreDeploymentResult,\n} from \"./types\";\n","/**\n * ComplyEdge TypeScript SDK — Client\n */\n\nimport axios, { AxiosInstance } from \"axios\";\nimport type {\n  ComplyEdgeConfig,\n  ComplianceContext,\n  ComplianceResult,\n  ComplianceViolation,\n  SensitivityDetection,\n  SensitivityResult,\n  PreDeploymentInput,\n  PreDeploymentResult,\n} from \"./types\";\n\nconst DEFAULT_BASE_URL = \"https://api.complyedge.io\";\n// Keep in sync with package.json. Hardcoding it here meant the User-Agent\n// silently reported a stale version after every release bump, which is the\n// one field support uses to tell which client a customer is actually on.\nconst SDK_VERSION = \"0.2.0\";\n\nexport class ComplyEdgeClient {\n  private http: AxiosInstance;\n  private agentId: string;\n  private jurisdiction?: string;\n\n  constructor(config: ComplyEdgeConfig) {\n    const baseUrl = config.baseUrl || process.env.COMPLYEDGE_API_URL || DEFAULT_BASE_URL;\n\n    this.agentId = config.agentId || \"default\";\n    this.jurisdiction = config.jurisdiction;\n\n    this.http = axios.create({\n      baseURL: baseUrl.replace(/\\/+$/, \"\"),\n      timeout: config.timeout || 30_000,\n      headers: {\n        Authorization: `Bearer ${config.apiKey}`,\n        \"Content-Type\": \"application/json\",\n        \"User-Agent\": `complyedge-typescript-sdk/${SDK_VERSION}`,\n      },\n    });\n  }\n\n  /**\n   * Run a compliance check on text input.\n   *\n   * Calls POST /v1/check: the deterministic OPA hot path. A decision here is\n   * evaluated against the Rego rule bundle, returns article-cited violations,\n   * and is written to the Article 12 audit trail (`auditLogged`).\n   */\n  async check(text: string, context?: ComplianceContext): Promise<ComplianceResult> {\n    const start = Date.now();\n    const jurisdiction = context?.jurisdiction || this.jurisdiction || \"EU\";\n\n    const response = await this.http.post(\"/v1/check\", {\n      text,\n      agent_id: context?.agentId || this.agentId,\n      jurisdiction,\n      // Pass the caller's direction through untouched. This previously mapped\n      // \"prompt\" to \"input\", a value the API's DirectionType enum does not\n      // accept (\"prompt\" | \"output\"), so every input check 422'd and the\n      // wrapped call threw. The SDK's own ComplianceContext type has always\n      // declared the correct union; only this line disagreed with it.\n      direction: context?.direction ?? \"output\",\n      use_semantic_fallback: false,\n      context: context?.userRole ? { user_role: context.userRole } : undefined,\n    });\n\n    const data = response.data;\n    const processingTimeMs = Date.now() - start;\n    const allowed = data.allowed !== false;\n\n    return {\n      eventId: data.event_id || \"\",\n      allowed,\n      status: allowed ? \"safe\" : \"violation\",\n      violations: (data.violations || []).map((v: Record<string, unknown>) => ({\n        ruleId: (v.rule_id as string) || \"\",\n        ruleDescription: (v.rule_description as string) || \"\",\n        severity: (v.severity as ComplianceViolation[\"severity\"]) || \"medium\",\n        reason: (v.reason as string) || \"\",\n        confidence: (v.confidence as number) ?? 1.0,\n        textExcerpt: v.text_excerpt as string | undefined,\n      })),\n      latencyMs: data.latency_ms || 0,\n      bundleVersion: data.bundle_version || \"\",\n      evaluatedRules: data.evaluated_rules || [],\n      enginePath: data.engine_path || \"opa\",\n      opaLatencyMs: data.opa_latency_ms,\n      auditLogged: data.audit_logged !== false,\n      textHash: data.text_hash || \"\",\n      timestamp: data.timestamp,\n      jurisdiction,\n      processingTimeMs,\n    };\n  }\n\n  /**\n   * Run proactive sensitivity detection on user input.\n   *\n   * Calls POST /v1/sensitivity/detect, which deliberately stays on the legacy\n   * TrustLint + LLM pipeline. It does NOT run OPA and does NOT write the\n   * Article 12 audit trail. Use `check()` for runtime EU AI Act enforcement.\n   */\n  async detectSensitivity(\n    text: string,\n    context?: ComplianceContext\n  ): Promise<SensitivityResult> {\n    const start = Date.now();\n    // \"EU\" matches the Python SDK and the server default. This read \"US\",\n    // so the two SDKs enforced different rule sets for identical code.\n    const jurisdiction = context?.jurisdiction || this.jurisdiction || \"EU\";\n\n    const response = await this.http.post(\"/v1/sensitivity/detect\", {\n      input_text: text,\n      agent_id: context?.agentId || this.agentId,\n      jurisdiction,\n      direction: context?.direction || \"prompt\",\n      user_role: context?.userRole,\n    });\n\n    const data = response.data;\n\n    return {\n      eventId: data.event_id || \"\",\n      status: data.overall_risk_assessment === \"safe\" ? \"safe\" : \"violation\",\n      detections: (data.detections || []).map((d: Record<string, unknown>) => ({\n        ruleId: (d.rule_id as string) || \"\",\n        severity: (d.severity as SensitivityDetection[\"severity\"]) || \"medium\",\n        regulation: (d.regulation as string) || \"\",\n        description: (d.description as string) || \"\",\n        article: d.article as string | undefined,\n        remediation: d.remediation as string | undefined,\n      })),\n      riskScore: data.overall_risk_score || 0,\n      jurisdiction,\n      processingTimeMs: Date.now() - start,\n    };\n  }\n\n  /**\n   * Run a pre-deployment assessment on an AI system configuration.\n   */\n  async assessPreDeployment(input: PreDeploymentInput): Promise<PreDeploymentResult> {\n    const response = await this.http.post(\"/v1/assessment/pre-deployment\", {\n      system_prompt: input.systemPrompt,\n      model_config: input.modelConfig\n        ? {\n            provider: input.modelConfig.provider,\n            model_id: input.modelConfig.modelId,\n            temperature: input.modelConfig.temperature,\n          }\n        : undefined,\n      agent_pipeline: input.agentPipeline\n        ? {\n            tools: input.agentPipeline.tools,\n            memory: input.agentPipeline.memory,\n            autonomy_level: input.agentPipeline.autonomyLevel,\n            human_oversight: input.agentPipeline.humanOversight,\n          }\n        : undefined,\n      jurisdiction: input.jurisdiction || \"EU\",\n    });\n\n    const data = response.data;\n    return {\n      complianceScore: data.compliance_score,\n      riskTier: data.risk_tier,\n      violations: (data.violations || []).map((v: Record<string, unknown>) => ({\n        ruleId: v.rule_id as string,\n        article: v.article as string,\n        description: v.description as string,\n        requiredAction: v.required_action as string,\n      })),\n      requiredDisclosures: data.required_disclosures || [],\n      euAiActCategory: data.eu_ai_act_category || \"\",\n      estimatedDeadline: data.estimated_deadline || \"\",\n    };\n  }\n}\n","/**\n * ComplyEdge OpenAI Middleware\n *\n * Wraps an OpenAI client to run compliance checks on messages\n * before they are sent to the model.\n *\n * Usage:\n *   import OpenAI from \"openai\";\n *   import { ComplyEdgeClient } from \"@complyedge/sdk\";\n *   import { withCompliance } from \"@complyedge/sdk/openai-middleware\";\n *\n *   const ce = new ComplyEdgeClient({ apiKey: \"...\" });\n *   const openai = withCompliance(new OpenAI(), ce);\n *   // Now openai.chat.completions.create() runs compliance checks automatically\n */\n\nimport type { ComplyEdgeClient } from \"./client\";\nimport type { ComplianceViolation } from \"./types\";\n\nexport class ComplianceError extends Error {\n  public violations: ComplianceViolation[];\n\n  constructor(message: string, violations: ComplianceViolation[]) {\n    super(message);\n    this.name = \"ComplianceError\";\n    this.violations = violations;\n  }\n}\n\n/**\n * Wrap an OpenAI client with ComplyEdge compliance checks.\n * The returned object proxies chat.completions.create() to check\n * user messages before sending to OpenAI.\n */\nexport function withCompliance<T extends Record<string, unknown>>(\n  openaiClient: T,\n  ceClient: ComplyEdgeClient,\n  options?: {\n    checkInput?: boolean;\n    checkOutput?: boolean;\n    jurisdiction?: string;\n    blockOnViolation?: boolean;\n  }\n): T {\n  const opts = {\n    checkInput: true,\n    checkOutput: false,\n    blockOnViolation: true,\n    ...options,\n  };\n\n  const chat = openaiClient.chat as Record<string, unknown> | undefined;\n  if (!chat || !chat.completions) {\n    return openaiClient; // Not an OpenAI-shaped client, return as-is\n  }\n\n  const completions = chat.completions as Record<string, unknown>;\n  const originalCreate = completions.create as (...args: unknown[]) => Promise<unknown>;\n\n  if (typeof originalCreate !== \"function\") {\n    return openaiClient;\n  }\n\n  completions.create = async function (...args: unknown[]) {\n    const params = args[0] as Record<string, unknown> | undefined;\n\n    if (opts.checkInput && params?.messages) {\n      const messages = params.messages as Array<{ role: string; content: unknown }>;\n      // Check EVERY user turn, not just the last one. A violation in an earlier\n      // message is still sent to the model verbatim, so checking only the tail\n      // left the majority of a multi-turn conversation unenforced.\n      for (const message of messages) {\n        if (message.role !== \"user\") continue;\n        for (const text of extractText(message.content)) {\n          const result = await ceClient.check(text, {\n            direction: \"prompt\",\n            jurisdiction: opts.jurisdiction,\n          });\n          if (!result.allowed && opts.blockOnViolation) {\n            throw new ComplianceError(\n              `Compliance violation detected: ${result.violations.map((v) => v.ruleId).join(\", \")}`,\n              result.violations\n            );\n          }\n        }\n      }\n    }\n\n    const response = await originalCreate.apply(this, args);\n\n    if (opts.checkOutput) {\n      // Previously declared in the options type and never read, so the README's\n      // \"runs compliance checks automatically\" was half true: inputs were\n      // checked, model output never was, silently.\n      for (const text of extractCompletionText(response)) {\n        const result = await ceClient.check(text, {\n          direction: \"output\",\n          jurisdiction: opts.jurisdiction,\n        });\n        if (!result.allowed && opts.blockOnViolation) {\n          throw new ComplianceError(\n            `Compliance violation in model output: ${result.violations.map((v) => v.ruleId).join(\", \")}`,\n            result.violations\n          );\n        }\n      }\n    }\n\n    return response;\n  };\n\n  return openaiClient;\n}\n\n/**\n * Pull checkable strings out of a message `content` field.\n *\n * OpenAI accepts either a plain string or an array of typed content parts.\n * The array form was previously passed to the API as a non-string and 422'd,\n * so multimodal callers could not use the middleware at all.\n */\nfunction extractText(content: unknown): string[] {\n  if (typeof content === \"string\") {\n    return content.trim() ? [content] : [];\n  }\n  if (Array.isArray(content)) {\n    return content\n      .map((part) => {\n        if (typeof part === \"string\") return part;\n        const p = part as Record<string, unknown> | null;\n        return p && typeof p.text === \"string\" ? p.text : \"\";\n      })\n      .filter((t) => t.trim().length > 0);\n  }\n  return [];\n}\n\n/** Pull assistant message text out of a chat completion response. */\nfunction extractCompletionText(response: unknown): string[] {\n  const r = response as { choices?: Array<{ message?: { content?: unknown } }> } | null;\n  if (!r?.choices) return [];\n  return r.choices.flatMap((choice) => extractText(choice?.message?.content));\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACIA,mBAAqC;AAYrC,IAAM,mBAAmB;AAIzB,IAAM,cAAc;AAEb,IAAM,mBAAN,MAAuB;AAAA,EACpB;AAAA,EACA;AAAA,EACA;AAAA,EAER,YAAY,QAA0B;AACpC,UAAM,UAAU,OAAO,WAAW,QAAQ,IAAI,sBAAsB;AAEpE,SAAK,UAAU,OAAO,WAAW;AACjC,SAAK,eAAe,OAAO;AAE3B,SAAK,OAAO,aAAAA,QAAM,OAAO;AAAA,MACvB,SAAS,QAAQ,QAAQ,QAAQ,EAAE;AAAA,MACnC,SAAS,OAAO,WAAW;AAAA,MAC3B,SAAS;AAAA,QACP,eAAe,UAAU,OAAO,MAAM;AAAA,QACtC,gBAAgB;AAAA,QAChB,cAAc,6BAA6B,WAAW;AAAA,MACxD;AAAA,IACF,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,MAAM,MAAc,SAAwD;AAChF,UAAM,QAAQ,KAAK,IAAI;AACvB,UAAM,eAAe,SAAS,gBAAgB,KAAK,gBAAgB;AAEnE,UAAM,WAAW,MAAM,KAAK,KAAK,KAAK,aAAa;AAAA,MACjD;AAAA,MACA,UAAU,SAAS,WAAW,KAAK;AAAA,MACnC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAMA,WAAW,SAAS,aAAa;AAAA,MACjC,uBAAuB;AAAA,MACvB,SAAS,SAAS,WAAW,EAAE,WAAW,QAAQ,SAAS,IAAI;AAAA,IACjE,CAAC;AAED,UAAM,OAAO,SAAS;AACtB,UAAM,mBAAmB,KAAK,IAAI,IAAI;AACtC,UAAM,UAAU,KAAK,YAAY;AAEjC,WAAO;AAAA,MACL,SAAS,KAAK,YAAY;AAAA,MAC1B;AAAA,MACA,QAAQ,UAAU,SAAS;AAAA,MAC3B,aAAa,KAAK,cAAc,CAAC,GAAG,IAAI,CAAC,OAAgC;AAAA,QACvE,QAAS,EAAE,WAAsB;AAAA,QACjC,iBAAkB,EAAE,oBAA+B;AAAA,QACnD,UAAW,EAAE,YAAgD;AAAA,QAC7D,QAAS,EAAE,UAAqB;AAAA,QAChC,YAAa,EAAE,cAAyB;AAAA,QACxC,aAAa,EAAE;AAAA,MACjB,EAAE;AAAA,MACF,WAAW,KAAK,cAAc;AAAA,MAC9B,eAAe,KAAK,kBAAkB;AAAA,MACtC,gBAAgB,KAAK,mBAAmB,CAAC;AAAA,MACzC,YAAY,KAAK,eAAe;AAAA,MAChC,cAAc,KAAK;AAAA,MACnB,aAAa,KAAK,iBAAiB;AAAA,MACnC,UAAU,KAAK,aAAa;AAAA,MAC5B,WAAW,KAAK;AAAA,MAChB;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,kBACJ,MACA,SAC4B;AAC5B,UAAM,QAAQ,KAAK,IAAI;AAGvB,UAAM,eAAe,SAAS,gBAAgB,KAAK,gBAAgB;AAEnE,UAAM,WAAW,MAAM,KAAK,KAAK,KAAK,0BAA0B;AAAA,MAC9D,YAAY;AAAA,MACZ,UAAU,SAAS,WAAW,KAAK;AAAA,MACnC;AAAA,MACA,WAAW,SAAS,aAAa;AAAA,MACjC,WAAW,SAAS;AAAA,IACtB,CAAC;AAED,UAAM,OAAO,SAAS;AAEtB,WAAO;AAAA,MACL,SAAS,KAAK,YAAY;AAAA,MAC1B,QAAQ,KAAK,4BAA4B,SAAS,SAAS;AAAA,MAC3D,aAAa,KAAK,cAAc,CAAC,GAAG,IAAI,CAAC,OAAgC;AAAA,QACvE,QAAS,EAAE,WAAsB;AAAA,QACjC,UAAW,EAAE,YAAiD;AAAA,QAC9D,YAAa,EAAE,cAAyB;AAAA,QACxC,aAAc,EAAE,eAA0B;AAAA,QAC1C,SAAS,EAAE;AAAA,QACX,aAAa,EAAE;AAAA,MACjB,EAAE;AAAA,MACF,WAAW,KAAK,sBAAsB;AAAA,MACtC;AAAA,MACA,kBAAkB,KAAK,IAAI,IAAI;AAAA,IACjC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,oBAAoB,OAAyD;AACjF,UAAM,WAAW,MAAM,KAAK,KAAK,KAAK,iCAAiC;AAAA,MACrE,eAAe,MAAM;AAAA,MACrB,cAAc,MAAM,cAChB;AAAA,QACE,UAAU,MAAM,YAAY;AAAA,QAC5B,UAAU,MAAM,YAAY;AAAA,QAC5B,aAAa,MAAM,YAAY;AAAA,MACjC,IACA;AAAA,MACJ,gBAAgB,MAAM,gBAClB;AAAA,QACE,OAAO,MAAM,cAAc;AAAA,QAC3B,QAAQ,MAAM,cAAc;AAAA,QAC5B,gBAAgB,MAAM,cAAc;AAAA,QACpC,iBAAiB,MAAM,cAAc;AAAA,MACvC,IACA;AAAA,MACJ,cAAc,MAAM,gBAAgB;AAAA,IACtC,CAAC;AAED,UAAM,OAAO,SAAS;AACtB,WAAO;AAAA,MACL,iBAAiB,KAAK;AAAA,MACtB,UAAU,KAAK;AAAA,MACf,aAAa,KAAK,cAAc,CAAC,GAAG,IAAI,CAAC,OAAgC;AAAA,QACvE,QAAQ,EAAE;AAAA,QACV,SAAS,EAAE;AAAA,QACX,aAAa,EAAE;AAAA,QACf,gBAAgB,EAAE;AAAA,MACpB,EAAE;AAAA,MACF,qBAAqB,KAAK,wBAAwB,CAAC;AAAA,MACnD,iBAAiB,KAAK,sBAAsB;AAAA,MAC5C,mBAAmB,KAAK,sBAAsB;AAAA,IAChD;AAAA,EACF;AACF;;;ACjKO,IAAM,kBAAN,cAA8B,MAAM;AAAA,EAClC;AAAA,EAEP,YAAY,SAAiB,YAAmC;AAC9D,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,aAAa;AAAA,EACpB;AACF;AAOO,SAAS,eACd,cACA,UACA,SAMG;AACH,QAAM,OAAO;AAAA,IACX,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,GAAG;AAAA,EACL;AAEA,QAAM,OAAO,aAAa;AAC1B,MAAI,CAAC,QAAQ,CAAC,KAAK,aAAa;AAC9B,WAAO;AAAA,EACT;AAEA,QAAM,cAAc,KAAK;AACzB,QAAM,iBAAiB,YAAY;AAEnC,MAAI,OAAO,mBAAmB,YAAY;AACxC,WAAO;AAAA,EACT;AAEA,cAAY,SAAS,kBAAmB,MAAiB;AACvD,UAAM,SAAS,KAAK,CAAC;AAErB,QAAI,KAAK,cAAc,QAAQ,UAAU;AACvC,YAAM,WAAW,OAAO;AAIxB,iBAAW,WAAW,UAAU;AAC9B,YAAI,QAAQ,SAAS,OAAQ;AAC7B,mBAAW,QAAQ,YAAY,QAAQ,OAAO,GAAG;AAC/C,gBAAM,SAAS,MAAM,SAAS,MAAM,MAAM;AAAA,YACxC,WAAW;AAAA,YACX,cAAc,KAAK;AAAA,UACrB,CAAC;AACD,cAAI,CAAC,OAAO,WAAW,KAAK,kBAAkB;AAC5C,kBAAM,IAAI;AAAA,cACR,kCAAkC,OAAO,WAAW,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,IAAI,CAAC;AAAA,cACnF,OAAO;AAAA,YACT;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,UAAM,WAAW,MAAM,eAAe,MAAM,MAAM,IAAI;AAEtD,QAAI,KAAK,aAAa;AAIpB,iBAAW,QAAQ,sBAAsB,QAAQ,GAAG;AAClD,cAAM,SAAS,MAAM,SAAS,MAAM,MAAM;AAAA,UACxC,WAAW;AAAA,UACX,cAAc,KAAK;AAAA,QACrB,CAAC;AACD,YAAI,CAAC,OAAO,WAAW,KAAK,kBAAkB;AAC5C,gBAAM,IAAI;AAAA,YACR,yCAAyC,OAAO,WAAW,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,IAAI,CAAC;AAAA,YAC1F,OAAO;AAAA,UACT;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAEA,SAAO;AACT;AASA,SAAS,YAAY,SAA4B;AAC/C,MAAI,OAAO,YAAY,UAAU;AAC/B,WAAO,QAAQ,KAAK,IAAI,CAAC,OAAO,IAAI,CAAC;AAAA,EACvC;AACA,MAAI,MAAM,QAAQ,OAAO,GAAG;AAC1B,WAAO,QACJ,IAAI,CAAC,SAAS;AACb,UAAI,OAAO,SAAS,SAAU,QAAO;AACrC,YAAM,IAAI;AACV,aAAO,KAAK,OAAO,EAAE,SAAS,WAAW,EAAE,OAAO;AAAA,IACpD,CAAC,EACA,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,CAAC;AAAA,EACtC;AACA,SAAO,CAAC;AACV;AAGA,SAAS,sBAAsB,UAA6B;AAC1D,QAAM,IAAI;AACV,MAAI,CAAC,GAAG,QAAS,QAAO,CAAC;AACzB,SAAO,EAAE,QAAQ,QAAQ,CAAC,WAAW,YAAY,QAAQ,SAAS,OAAO,CAAC;AAC5E;","names":["axios"]}

package/dist/index.mjs

@@ -1,7 +1,7 @@
 import {
   ComplianceError,
   withCompliance
-} from "./chunk-KZYIMMVM.mjs";
+} from "./chunk-X7L22AQP.mjs";
 
 // src/client.ts
 import axios from "axios";
@@ -39,7 +39,12 @@ var ComplyEdgeClient = class {
       text,
       agent_id: context?.agentId || this.agentId,
       jurisdiction,
-      direction: context?.direction === "prompt" ? "input" : "output",
+      // Pass the caller's direction through untouched. This previously mapped
+      // "prompt" to "input", a value the API's DirectionType enum does not
+      // accept ("prompt" | "output"), so every input check 422'd and the
+      // wrapped call threw. The SDK's own ComplianceContext type has always
+      // declared the correct union; only this line disagreed with it.
+      direction: context?.direction ?? "output",
       use_semantic_fallback: false,
       context: context?.userRole ? { user_role: context.userRole } : void 0
     });
@@ -64,6 +69,8 @@ var ComplyEdgeClient = class {
       enginePath: data.engine_path || "opa",
       opaLatencyMs: data.opa_latency_ms,
       auditLogged: data.audit_logged !== false,
+      textHash: data.text_hash || "",
+      timestamp: data.timestamp,
       jurisdiction,
       processingTimeMs
     };
@@ -77,7 +84,7 @@ var ComplyEdgeClient = class {
    */
   async detectSensitivity(text, context) {
     const start = Date.now();
-    const jurisdiction = context?.jurisdiction || this.jurisdiction || "US";
+    const jurisdiction = context?.jurisdiction || this.jurisdiction || "EU";
     const response = await this.http.post("/v1/sensitivity/detect", {
       input_text: text,
       agent_id: context?.agentId || this.agentId,

package/dist/index.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/client.ts"],"sourcesContent":["/**\n * ComplyEdge TypeScript SDK — Client\n */\n\nimport axios, { AxiosInstance } from \"axios\";\nimport type {\n  ComplyEdgeConfig,\n  ComplianceContext,\n  ComplianceResult,\n  ComplianceViolation,\n  SensitivityDetection,\n  SensitivityResult,\n  PreDeploymentInput,\n  PreDeploymentResult,\n} from \"./types\";\n\nconst DEFAULT_BASE_URL = \"https://api.complyedge.io\";\nconst SDK_VERSION = \"0.2.0\";\n\nexport class ComplyEdgeClient {\n  private http: AxiosInstance;\n  private agentId: string;\n  private jurisdiction?: string;\n\n  constructor(config: ComplyEdgeConfig) {\n    const baseUrl = config.baseUrl || process.env.COMPLYEDGE_API_URL || DEFAULT_BASE_URL;\n\n    this.agentId = config.agentId || \"default\";\n    this.jurisdiction = config.jurisdiction;\n\n    this.http = axios.create({\n      baseURL: baseUrl.replace(/\\/+$/, \"\"),\n      timeout: config.timeout || 30_000,\n      headers: {\n        Authorization: `Bearer ${config.apiKey}`,\n        \"Content-Type\": \"application/json\",\n        \"User-Agent\": `complyedge-typescript-sdk/${SDK_VERSION}`,\n      },\n    });\n  }\n\n  /**\n   * Run a compliance check on text input.\n   *\n   * Calls POST /v1/check: the deterministic OPA hot path. A decision here is\n   * evaluated against the Rego rule bundle, returns article-cited violations,\n   * and is written to the Article 12 audit trail (`auditLogged`).\n   */\n  async check(text: string, context?: ComplianceContext): Promise<ComplianceResult> {\n    const start = Date.now();\n    const jurisdiction = context?.jurisdiction || this.jurisdiction || \"EU\";\n\n    const response = await this.http.post(\"/v1/check\", {\n      text,\n      agent_id: context?.agentId || this.agentId,\n      jurisdiction,\n      direction: context?.direction === \"prompt\" ? \"input\" : \"output\",\n      use_semantic_fallback: false,\n      context: context?.userRole ? { user_role: context.userRole } : undefined,\n    });\n\n    const data = response.data;\n    const processingTimeMs = Date.now() - start;\n    const allowed = data.allowed !== false;\n\n    return {\n      eventId: data.event_id || \"\",\n      allowed,\n      status: allowed ? \"safe\" : \"violation\",\n      violations: (data.violations || []).map((v: Record<string, unknown>) => ({\n        ruleId: (v.rule_id as string) || \"\",\n        ruleDescription: (v.rule_description as string) || \"\",\n        severity: (v.severity as ComplianceViolation[\"severity\"]) || \"medium\",\n        reason: (v.reason as string) || \"\",\n        confidence: (v.confidence as number) ?? 1.0,\n        textExcerpt: v.text_excerpt as string | undefined,\n      })),\n      latencyMs: data.latency_ms || 0,\n      bundleVersion: data.bundle_version || \"\",\n      evaluatedRules: data.evaluated_rules || [],\n      enginePath: data.engine_path || \"opa\",\n      opaLatencyMs: data.opa_latency_ms,\n      auditLogged: data.audit_logged !== false,\n      jurisdiction,\n      processingTimeMs,\n    };\n  }\n\n  /**\n   * Run proactive sensitivity detection on user input.\n   *\n   * Calls POST /v1/sensitivity/detect, which deliberately stays on the legacy\n   * TrustLint + LLM pipeline. It does NOT run OPA and does NOT write the\n   * Article 12 audit trail. Use `check()` for runtime EU AI Act enforcement.\n   */\n  async detectSensitivity(\n    text: string,\n    context?: ComplianceContext\n  ): Promise<SensitivityResult> {\n    const start = Date.now();\n    const jurisdiction = context?.jurisdiction || this.jurisdiction || \"US\";\n\n    const response = await this.http.post(\"/v1/sensitivity/detect\", {\n      input_text: text,\n      agent_id: context?.agentId || this.agentId,\n      jurisdiction,\n      direction: context?.direction || \"prompt\",\n      user_role: context?.userRole,\n    });\n\n    const data = response.data;\n\n    return {\n      eventId: data.event_id || \"\",\n      status: data.overall_risk_assessment === \"safe\" ? \"safe\" : \"violation\",\n      detections: (data.detections || []).map((d: Record<string, unknown>) => ({\n        ruleId: (d.rule_id as string) || \"\",\n        severity: (d.severity as SensitivityDetection[\"severity\"]) || \"medium\",\n        regulation: (d.regulation as string) || \"\",\n        description: (d.description as string) || \"\",\n        article: d.article as string | undefined,\n        remediation: d.remediation as string | undefined,\n      })),\n      riskScore: data.overall_risk_score || 0,\n      jurisdiction,\n      processingTimeMs: Date.now() - start,\n    };\n  }\n\n  /**\n   * Run a pre-deployment assessment on an AI system configuration.\n   */\n  async assessPreDeployment(input: PreDeploymentInput): Promise<PreDeploymentResult> {\n    const response = await this.http.post(\"/v1/assessment/pre-deployment\", {\n      system_prompt: input.systemPrompt,\n      model_config: input.modelConfig\n        ? {\n            provider: input.modelConfig.provider,\n            model_id: input.modelConfig.modelId,\n            temperature: input.modelConfig.temperature,\n          }\n        : undefined,\n      agent_pipeline: input.agentPipeline\n        ? {\n            tools: input.agentPipeline.tools,\n            memory: input.agentPipeline.memory,\n            autonomy_level: input.agentPipeline.autonomyLevel,\n            human_oversight: input.agentPipeline.humanOversight,\n          }\n        : undefined,\n      jurisdiction: input.jurisdiction || \"EU\",\n    });\n\n    const data = response.data;\n    return {\n      complianceScore: data.compliance_score,\n      riskTier: data.risk_tier,\n      violations: (data.violations || []).map((v: Record<string, unknown>) => ({\n        ruleId: v.rule_id as string,\n        article: v.article as string,\n        description: v.description as string,\n        requiredAction: v.required_action as string,\n      })),\n      requiredDisclosures: data.required_disclosures || [],\n      euAiActCategory: data.eu_ai_act_category || \"\",\n      estimatedDeadline: data.estimated_deadline || \"\",\n    };\n  }\n}\n"],"mappings":";;;;;;AAIA,OAAO,WAA8B;AAYrC,IAAM,mBAAmB;AACzB,IAAM,cAAc;AAEb,IAAM,mBAAN,MAAuB;AAAA,EACpB;AAAA,EACA;AAAA,EACA;AAAA,EAER,YAAY,QAA0B;AACpC,UAAM,UAAU,OAAO,WAAW,QAAQ,IAAI,sBAAsB;AAEpE,SAAK,UAAU,OAAO,WAAW;AACjC,SAAK,eAAe,OAAO;AAE3B,SAAK,OAAO,MAAM,OAAO;AAAA,MACvB,SAAS,QAAQ,QAAQ,QAAQ,EAAE;AAAA,MACnC,SAAS,OAAO,WAAW;AAAA,MAC3B,SAAS;AAAA,QACP,eAAe,UAAU,OAAO,MAAM;AAAA,QACtC,gBAAgB;AAAA,QAChB,cAAc,6BAA6B,WAAW;AAAA,MACxD;AAAA,IACF,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,MAAM,MAAc,SAAwD;AAChF,UAAM,QAAQ,KAAK,IAAI;AACvB,UAAM,eAAe,SAAS,gBAAgB,KAAK,gBAAgB;AAEnE,UAAM,WAAW,MAAM,KAAK,KAAK,KAAK,aAAa;AAAA,MACjD;AAAA,MACA,UAAU,SAAS,WAAW,KAAK;AAAA,MACnC;AAAA,MACA,WAAW,SAAS,cAAc,WAAW,UAAU;AAAA,MACvD,uBAAuB;AAAA,MACvB,SAAS,SAAS,WAAW,EAAE,WAAW,QAAQ,SAAS,IAAI;AAAA,IACjE,CAAC;AAED,UAAM,OAAO,SAAS;AACtB,UAAM,mBAAmB,KAAK,IAAI,IAAI;AACtC,UAAM,UAAU,KAAK,YAAY;AAEjC,WAAO;AAAA,MACL,SAAS,KAAK,YAAY;AAAA,MAC1B;AAAA,MACA,QAAQ,UAAU,SAAS;AAAA,MAC3B,aAAa,KAAK,cAAc,CAAC,GAAG,IAAI,CAAC,OAAgC;AAAA,QACvE,QAAS,EAAE,WAAsB;AAAA,QACjC,iBAAkB,EAAE,oBAA+B;AAAA,QACnD,UAAW,EAAE,YAAgD;AAAA,QAC7D,QAAS,EAAE,UAAqB;AAAA,QAChC,YAAa,EAAE,cAAyB;AAAA,QACxC,aAAa,EAAE;AAAA,MACjB,EAAE;AAAA,MACF,WAAW,KAAK,cAAc;AAAA,MAC9B,eAAe,KAAK,kBAAkB;AAAA,MACtC,gBAAgB,KAAK,mBAAmB,CAAC;AAAA,MACzC,YAAY,KAAK,eAAe;AAAA,MAChC,cAAc,KAAK;AAAA,MACnB,aAAa,KAAK,iBAAiB;AAAA,MACnC;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,kBACJ,MACA,SAC4B;AAC5B,UAAM,QAAQ,KAAK,IAAI;AACvB,UAAM,eAAe,SAAS,gBAAgB,KAAK,gBAAgB;AAEnE,UAAM,WAAW,MAAM,KAAK,KAAK,KAAK,0BAA0B;AAAA,MAC9D,YAAY;AAAA,MACZ,UAAU,SAAS,WAAW,KAAK;AAAA,MACnC;AAAA,MACA,WAAW,SAAS,aAAa;AAAA,MACjC,WAAW,SAAS;AAAA,IACtB,CAAC;AAED,UAAM,OAAO,SAAS;AAEtB,WAAO;AAAA,MACL,SAAS,KAAK,YAAY;AAAA,MAC1B,QAAQ,KAAK,4BAA4B,SAAS,SAAS;AAAA,MAC3D,aAAa,KAAK,cAAc,CAAC,GAAG,IAAI,CAAC,OAAgC;AAAA,QACvE,QAAS,EAAE,WAAsB;AAAA,QACjC,UAAW,EAAE,YAAiD;AAAA,QAC9D,YAAa,EAAE,cAAyB;AAAA,QACxC,aAAc,EAAE,eAA0B;AAAA,QAC1C,SAAS,EAAE;AAAA,QACX,aAAa,EAAE;AAAA,MACjB,EAAE;AAAA,MACF,WAAW,KAAK,sBAAsB;AAAA,MACtC;AAAA,MACA,kBAAkB,KAAK,IAAI,IAAI;AAAA,IACjC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,oBAAoB,OAAyD;AACjF,UAAM,WAAW,MAAM,KAAK,KAAK,KAAK,iCAAiC;AAAA,MACrE,eAAe,MAAM;AAAA,MACrB,cAAc,MAAM,cAChB;AAAA,QACE,UAAU,MAAM,YAAY;AAAA,QAC5B,UAAU,MAAM,YAAY;AAAA,QAC5B,aAAa,MAAM,YAAY;AAAA,MACjC,IACA;AAAA,MACJ,gBAAgB,MAAM,gBAClB;AAAA,QACE,OAAO,MAAM,cAAc;AAAA,QAC3B,QAAQ,MAAM,cAAc;AAAA,QAC5B,gBAAgB,MAAM,cAAc;AAAA,QACpC,iBAAiB,MAAM,cAAc;AAAA,MACvC,IACA;AAAA,MACJ,cAAc,MAAM,gBAAgB;AAAA,IACtC,CAAC;AAED,UAAM,OAAO,SAAS;AACtB,WAAO;AAAA,MACL,iBAAiB,KAAK;AAAA,MACtB,UAAU,KAAK;AAAA,MACf,aAAa,KAAK,cAAc,CAAC,GAAG,IAAI,CAAC,OAAgC;AAAA,QACvE,QAAQ,EAAE;AAAA,QACV,SAAS,EAAE;AAAA,QACX,aAAa,EAAE;AAAA,QACf,gBAAgB,EAAE;AAAA,MACpB,EAAE;AAAA,MACF,qBAAqB,KAAK,wBAAwB,CAAC;AAAA,MACnD,iBAAiB,KAAK,sBAAsB;AAAA,MAC5C,mBAAmB,KAAK,sBAAsB;AAAA,IAChD;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../src/client.ts"],"sourcesContent":["/**\n * ComplyEdge TypeScript SDK — Client\n */\n\nimport axios, { AxiosInstance } from \"axios\";\nimport type {\n  ComplyEdgeConfig,\n  ComplianceContext,\n  ComplianceResult,\n  ComplianceViolation,\n  SensitivityDetection,\n  SensitivityResult,\n  PreDeploymentInput,\n  PreDeploymentResult,\n} from \"./types\";\n\nconst DEFAULT_BASE_URL = \"https://api.complyedge.io\";\n// Keep in sync with package.json. Hardcoding it here meant the User-Agent\n// silently reported a stale version after every release bump, which is the\n// one field support uses to tell which client a customer is actually on.\nconst SDK_VERSION = \"0.2.0\";\n\nexport class ComplyEdgeClient {\n  private http: AxiosInstance;\n  private agentId: string;\n  private jurisdiction?: string;\n\n  constructor(config: ComplyEdgeConfig) {\n    const baseUrl = config.baseUrl || process.env.COMPLYEDGE_API_URL || DEFAULT_BASE_URL;\n\n    this.agentId = config.agentId || \"default\";\n    this.jurisdiction = config.jurisdiction;\n\n    this.http = axios.create({\n      baseURL: baseUrl.replace(/\\/+$/, \"\"),\n      timeout: config.timeout || 30_000,\n      headers: {\n        Authorization: `Bearer ${config.apiKey}`,\n        \"Content-Type\": \"application/json\",\n        \"User-Agent\": `complyedge-typescript-sdk/${SDK_VERSION}`,\n      },\n    });\n  }\n\n  /**\n   * Run a compliance check on text input.\n   *\n   * Calls POST /v1/check: the deterministic OPA hot path. A decision here is\n   * evaluated against the Rego rule bundle, returns article-cited violations,\n   * and is written to the Article 12 audit trail (`auditLogged`).\n   */\n  async check(text: string, context?: ComplianceContext): Promise<ComplianceResult> {\n    const start = Date.now();\n    const jurisdiction = context?.jurisdiction || this.jurisdiction || \"EU\";\n\n    const response = await this.http.post(\"/v1/check\", {\n      text,\n      agent_id: context?.agentId || this.agentId,\n      jurisdiction,\n      // Pass the caller's direction through untouched. This previously mapped\n      // \"prompt\" to \"input\", a value the API's DirectionType enum does not\n      // accept (\"prompt\" | \"output\"), so every input check 422'd and the\n      // wrapped call threw. The SDK's own ComplianceContext type has always\n      // declared the correct union; only this line disagreed with it.\n      direction: context?.direction ?? \"output\",\n      use_semantic_fallback: false,\n      context: context?.userRole ? { user_role: context.userRole } : undefined,\n    });\n\n    const data = response.data;\n    const processingTimeMs = Date.now() - start;\n    const allowed = data.allowed !== false;\n\n    return {\n      eventId: data.event_id || \"\",\n      allowed,\n      status: allowed ? \"safe\" : \"violation\",\n      violations: (data.violations || []).map((v: Record<string, unknown>) => ({\n        ruleId: (v.rule_id as string) || \"\",\n        ruleDescription: (v.rule_description as string) || \"\",\n        severity: (v.severity as ComplianceViolation[\"severity\"]) || \"medium\",\n        reason: (v.reason as string) || \"\",\n        confidence: (v.confidence as number) ?? 1.0,\n        textExcerpt: v.text_excerpt as string | undefined,\n      })),\n      latencyMs: data.latency_ms || 0,\n      bundleVersion: data.bundle_version || \"\",\n      evaluatedRules: data.evaluated_rules || [],\n      enginePath: data.engine_path || \"opa\",\n      opaLatencyMs: data.opa_latency_ms,\n      auditLogged: data.audit_logged !== false,\n      textHash: data.text_hash || \"\",\n      timestamp: data.timestamp,\n      jurisdiction,\n      processingTimeMs,\n    };\n  }\n\n  /**\n   * Run proactive sensitivity detection on user input.\n   *\n   * Calls POST /v1/sensitivity/detect, which deliberately stays on the legacy\n   * TrustLint + LLM pipeline. It does NOT run OPA and does NOT write the\n   * Article 12 audit trail. Use `check()` for runtime EU AI Act enforcement.\n   */\n  async detectSensitivity(\n    text: string,\n    context?: ComplianceContext\n  ): Promise<SensitivityResult> {\n    const start = Date.now();\n    // \"EU\" matches the Python SDK and the server default. This read \"US\",\n    // so the two SDKs enforced different rule sets for identical code.\n    const jurisdiction = context?.jurisdiction || this.jurisdiction || \"EU\";\n\n    const response = await this.http.post(\"/v1/sensitivity/detect\", {\n      input_text: text,\n      agent_id: context?.agentId || this.agentId,\n      jurisdiction,\n      direction: context?.direction || \"prompt\",\n      user_role: context?.userRole,\n    });\n\n    const data = response.data;\n\n    return {\n      eventId: data.event_id || \"\",\n      status: data.overall_risk_assessment === \"safe\" ? \"safe\" : \"violation\",\n      detections: (data.detections || []).map((d: Record<string, unknown>) => ({\n        ruleId: (d.rule_id as string) || \"\",\n        severity: (d.severity as SensitivityDetection[\"severity\"]) || \"medium\",\n        regulation: (d.regulation as string) || \"\",\n        description: (d.description as string) || \"\",\n        article: d.article as string | undefined,\n        remediation: d.remediation as string | undefined,\n      })),\n      riskScore: data.overall_risk_score || 0,\n      jurisdiction,\n      processingTimeMs: Date.now() - start,\n    };\n  }\n\n  /**\n   * Run a pre-deployment assessment on an AI system configuration.\n   */\n  async assessPreDeployment(input: PreDeploymentInput): Promise<PreDeploymentResult> {\n    const response = await this.http.post(\"/v1/assessment/pre-deployment\", {\n      system_prompt: input.systemPrompt,\n      model_config: input.modelConfig\n        ? {\n            provider: input.modelConfig.provider,\n            model_id: input.modelConfig.modelId,\n            temperature: input.modelConfig.temperature,\n          }\n        : undefined,\n      agent_pipeline: input.agentPipeline\n        ? {\n            tools: input.agentPipeline.tools,\n            memory: input.agentPipeline.memory,\n            autonomy_level: input.agentPipeline.autonomyLevel,\n            human_oversight: input.agentPipeline.humanOversight,\n          }\n        : undefined,\n      jurisdiction: input.jurisdiction || \"EU\",\n    });\n\n    const data = response.data;\n    return {\n      complianceScore: data.compliance_score,\n      riskTier: data.risk_tier,\n      violations: (data.violations || []).map((v: Record<string, unknown>) => ({\n        ruleId: v.rule_id as string,\n        article: v.article as string,\n        description: v.description as string,\n        requiredAction: v.required_action as string,\n      })),\n      requiredDisclosures: data.required_disclosures || [],\n      euAiActCategory: data.eu_ai_act_category || \"\",\n      estimatedDeadline: data.estimated_deadline || \"\",\n    };\n  }\n}\n"],"mappings":";;;;;;AAIA,OAAO,WAA8B;AAYrC,IAAM,mBAAmB;AAIzB,IAAM,cAAc;AAEb,IAAM,mBAAN,MAAuB;AAAA,EACpB;AAAA,EACA;AAAA,EACA;AAAA,EAER,YAAY,QAA0B;AACpC,UAAM,UAAU,OAAO,WAAW,QAAQ,IAAI,sBAAsB;AAEpE,SAAK,UAAU,OAAO,WAAW;AACjC,SAAK,eAAe,OAAO;AAE3B,SAAK,OAAO,MAAM,OAAO;AAAA,MACvB,SAAS,QAAQ,QAAQ,QAAQ,EAAE;AAAA,MACnC,SAAS,OAAO,WAAW;AAAA,MAC3B,SAAS;AAAA,QACP,eAAe,UAAU,OAAO,MAAM;AAAA,QACtC,gBAAgB;AAAA,QAChB,cAAc,6BAA6B,WAAW;AAAA,MACxD;AAAA,IACF,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,MAAM,MAAc,SAAwD;AAChF,UAAM,QAAQ,KAAK,IAAI;AACvB,UAAM,eAAe,SAAS,gBAAgB,KAAK,gBAAgB;AAEnE,UAAM,WAAW,MAAM,KAAK,KAAK,KAAK,aAAa;AAAA,MACjD;AAAA,MACA,UAAU,SAAS,WAAW,KAAK;AAAA,MACnC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAMA,WAAW,SAAS,aAAa;AAAA,MACjC,uBAAuB;AAAA,MACvB,SAAS,SAAS,WAAW,EAAE,WAAW,QAAQ,SAAS,IAAI;AAAA,IACjE,CAAC;AAED,UAAM,OAAO,SAAS;AACtB,UAAM,mBAAmB,KAAK,IAAI,IAAI;AACtC,UAAM,UAAU,KAAK,YAAY;AAEjC,WAAO;AAAA,MACL,SAAS,KAAK,YAAY;AAAA,MAC1B;AAAA,MACA,QAAQ,UAAU,SAAS;AAAA,MAC3B,aAAa,KAAK,cAAc,CAAC,GAAG,IAAI,CAAC,OAAgC;AAAA,QACvE,QAAS,EAAE,WAAsB;AAAA,QACjC,iBAAkB,EAAE,oBAA+B;AAAA,QACnD,UAAW,EAAE,YAAgD;AAAA,QAC7D,QAAS,EAAE,UAAqB;AAAA,QAChC,YAAa,EAAE,cAAyB;AAAA,QACxC,aAAa,EAAE;AAAA,MACjB,EAAE;AAAA,MACF,WAAW,KAAK,cAAc;AAAA,MAC9B,eAAe,KAAK,kBAAkB;AAAA,MACtC,gBAAgB,KAAK,mBAAmB,CAAC;AAAA,MACzC,YAAY,KAAK,eAAe;AAAA,MAChC,cAAc,KAAK;AAAA,MACnB,aAAa,KAAK,iBAAiB;AAAA,MACnC,UAAU,KAAK,aAAa;AAAA,MAC5B,WAAW,KAAK;AAAA,MAChB;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,kBACJ,MACA,SAC4B;AAC5B,UAAM,QAAQ,KAAK,IAAI;AAGvB,UAAM,eAAe,SAAS,gBAAgB,KAAK,gBAAgB;AAEnE,UAAM,WAAW,MAAM,KAAK,KAAK,KAAK,0BAA0B;AAAA,MAC9D,YAAY;AAAA,MACZ,UAAU,SAAS,WAAW,KAAK;AAAA,MACnC;AAAA,MACA,WAAW,SAAS,aAAa;AAAA,MACjC,WAAW,SAAS;AAAA,IACtB,CAAC;AAED,UAAM,OAAO,SAAS;AAEtB,WAAO;AAAA,MACL,SAAS,KAAK,YAAY;AAAA,MAC1B,QAAQ,KAAK,4BAA4B,SAAS,SAAS;AAAA,MAC3D,aAAa,KAAK,cAAc,CAAC,GAAG,IAAI,CAAC,OAAgC;AAAA,QACvE,QAAS,EAAE,WAAsB;AAAA,QACjC,UAAW,EAAE,YAAiD;AAAA,QAC9D,YAAa,EAAE,cAAyB;AAAA,QACxC,aAAc,EAAE,eAA0B;AAAA,QAC1C,SAAS,EAAE;AAAA,QACX,aAAa,EAAE;AAAA,MACjB,EAAE;AAAA,MACF,WAAW,KAAK,sBAAsB;AAAA,MACtC;AAAA,MACA,kBAAkB,KAAK,IAAI,IAAI;AAAA,IACjC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,oBAAoB,OAAyD;AACjF,UAAM,WAAW,MAAM,KAAK,KAAK,KAAK,iCAAiC;AAAA,MACrE,eAAe,MAAM;AAAA,MACrB,cAAc,MAAM,cAChB;AAAA,QACE,UAAU,MAAM,YAAY;AAAA,QAC5B,UAAU,MAAM,YAAY;AAAA,QAC5B,aAAa,MAAM,YAAY;AAAA,MACjC,IACA;AAAA,MACJ,gBAAgB,MAAM,gBAClB;AAAA,QACE,OAAO,MAAM,cAAc;AAAA,QAC3B,QAAQ,MAAM,cAAc;AAAA,QAC5B,gBAAgB,MAAM,cAAc;AAAA,QACpC,iBAAiB,MAAM,cAAc;AAAA,MACvC,IACA;AAAA,MACJ,cAAc,MAAM,gBAAgB;AAAA,IACtC,CAAC;AAED,UAAM,OAAO,SAAS;AACtB,WAAO;AAAA,MACL,iBAAiB,KAAK;AAAA,MACtB,UAAU,KAAK;AAAA,MACf,aAAa,KAAK,cAAc,CAAC,GAAG,IAAI,CAAC,OAAgC;AAAA,QACvE,QAAQ,EAAE;AAAA,QACV,SAAS,EAAE;AAAA,QACX,aAAa,EAAE;AAAA,QACf,gBAAgB,EAAE;AAAA,MACpB,EAAE;AAAA,MACF,qBAAqB,KAAK,wBAAwB,CAAC;AAAA,MACnD,iBAAiB,KAAK,sBAAsB;AAAA,MAC5C,mBAAmB,KAAK,sBAAsB;AAAA,IAChD;AAAA,EACF;AACF;","names":[]}

package/dist/openai-middleware.d.mts

@@ -33,6 +33,14 @@ interface ComplianceResult {
     enginePath: string;
     opaLatencyMs?: number;
     auditLogged: boolean;
+    /**
+     * SHA-256 of the evaluated text as a bare hex digest, byte-identical to this
+     * event's Article 12 audit entry. Binds the decision to its exact input
+     * without a second call to the audit endpoint. The text is never stored.
+     */
+    textHash: string;
+    /** UTC instant the evaluation started, matching the audit entry. */
+    timestamp?: string;
     jurisdiction: string;
     /** Client-measured round trip, including network. */
     processingTimeMs: number;

package/dist/openai-middleware.d.ts

@@ -33,6 +33,14 @@ interface ComplianceResult {
     enginePath: string;
     opaLatencyMs?: number;
     auditLogged: boolean;
+    /**
+     * SHA-256 of the evaluated text as a bare hex digest, byte-identical to this
+     * event's Article 12 audit entry. Binds the decision to its exact input
+     * without a second call to the audit endpoint. The text is never stored.
+     */
+    textHash: string;
+    /** UTC instant the evaluation started, matching the audit entry. */
+    timestamp?: string;
     jurisdiction: string;
     /** Client-measured round trip, including network. */
     processingTimeMs: number;

package/dist/openai-middleware.js

@@ -52,25 +52,59 @@ function withCompliance(openaiClient, ceClient, options) {
     const params = args[0];
     if (opts.checkInput && params?.messages) {
       const messages = params.messages;
-      const userMessages = messages.filter((m) => m.role === "user");
-      const lastUserMessage = userMessages[userMessages.length - 1];
-      if (lastUserMessage?.content) {
-        const result = await ceClient.check(lastUserMessage.content, {
-          direction: "prompt",
+      for (const message of messages) {
+        if (message.role !== "user") continue;
+        for (const text of extractText(message.content)) {
+          const result = await ceClient.check(text, {
+            direction: "prompt",
+            jurisdiction: opts.jurisdiction
+          });
+          if (!result.allowed && opts.blockOnViolation) {
+            throw new ComplianceError(
+              `Compliance violation detected: ${result.violations.map((v) => v.ruleId).join(", ")}`,
+              result.violations
+            );
+          }
+        }
+      }
+    }
+    const response = await originalCreate.apply(this, args);
+    if (opts.checkOutput) {
+      for (const text of extractCompletionText(response)) {
+        const result = await ceClient.check(text, {
+          direction: "output",
           jurisdiction: opts.jurisdiction
         });
         if (!result.allowed && opts.blockOnViolation) {
           throw new ComplianceError(
-            `Compliance violation detected: ${result.violations.map((v) => v.ruleId).join(", ")}`,
+            `Compliance violation in model output: ${result.violations.map((v) => v.ruleId).join(", ")}`,
             result.violations
           );
         }
       }
     }
-    return originalCreate.apply(this, args);
+    return response;
   };
   return openaiClient;
 }
+function extractText(content) {
+  if (typeof content === "string") {
+    return content.trim() ? [content] : [];
+  }
+  if (Array.isArray(content)) {
+    return content.map((part) => {
+      if (typeof part === "string") return part;
+      const p = part;
+      return p && typeof p.text === "string" ? p.text : "";
+    }).filter((t) => t.trim().length > 0);
+  }
+  return [];
+}
+function extractCompletionText(response) {
+  const r = response;
+  if (!r?.choices) return [];
+  return r.choices.flatMap((choice) => extractText(choice?.message?.content));
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   ComplianceError,

package/dist/openai-middleware.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/openai-middleware.ts"],"sourcesContent":["/**\n * ComplyEdge OpenAI Middleware\n *\n * Wraps an OpenAI client to run compliance checks on messages\n * before they are sent to the model.\n *\n * Usage:\n *   import OpenAI from \"openai\";\n *   import { ComplyEdgeClient } from \"@complyedge/sdk\";\n *   import { withCompliance } from \"@complyedge/sdk/openai-middleware\";\n *\n *   const ce = new ComplyEdgeClient({ apiKey: \"...\" });\n *   const openai = withCompliance(new OpenAI(), ce);\n *   // Now openai.chat.completions.create() runs compliance checks automatically\n */\n\nimport type { ComplyEdgeClient } from \"./client\";\nimport type { ComplianceViolation } from \"./types\";\n\nexport class ComplianceError extends Error {\n  public violations: ComplianceViolation[];\n\n  constructor(message: string, violations: ComplianceViolation[]) {\n    super(message);\n    this.name = \"ComplianceError\";\n    this.violations = violations;\n  }\n}\n\n/**\n * Wrap an OpenAI client with ComplyEdge compliance checks.\n * The returned object proxies chat.completions.create() to check\n * user messages before sending to OpenAI.\n */\nexport function withCompliance<T extends Record<string, unknown>>(\n  openaiClient: T,\n  ceClient: ComplyEdgeClient,\n  options?: {\n    checkInput?: boolean;\n    checkOutput?: boolean;\n    jurisdiction?: string;\n    blockOnViolation?: boolean;\n  }\n): T {\n  const opts = {\n    checkInput: true,\n    checkOutput: false,\n    blockOnViolation: true,\n    ...options,\n  };\n\n  const chat = openaiClient.chat as Record<string, unknown> | undefined;\n  if (!chat || !chat.completions) {\n    return openaiClient; // Not an OpenAI-shaped client, return as-is\n  }\n\n  const completions = chat.completions as Record<string, unknown>;\n  const originalCreate = completions.create as (...args: unknown[]) => Promise<unknown>;\n\n  if (typeof originalCreate !== \"function\") {\n    return openaiClient;\n  }\n\n  completions.create = async function (...args: unknown[]) {\n    const params = args[0] as Record<string, unknown> | undefined;\n\n    if (opts.checkInput && params?.messages) {\n      const messages = params.messages as Array<{ role: string; content: string }>;\n      const userMessages = messages.filter((m) => m.role === \"user\");\n      const lastUserMessage = userMessages[userMessages.length - 1];\n\n      if (lastUserMessage?.content) {\n        const result = await ceClient.check(lastUserMessage.content, {\n          direction: \"prompt\",\n          jurisdiction: opts.jurisdiction,\n        });\n\n        if (!result.allowed && opts.blockOnViolation) {\n          throw new ComplianceError(\n            `Compliance violation detected: ${result.violations.map((v) => v.ruleId).join(\", \")}`,\n            result.violations\n          );\n        }\n      }\n    }\n\n    return originalCreate.apply(this, args);\n  };\n\n  return openaiClient;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAmBO,IAAM,kBAAN,cAA8B,MAAM;AAAA,EAClC;AAAA,EAEP,YAAY,SAAiB,YAAmC;AAC9D,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,aAAa;AAAA,EACpB;AACF;AAOO,SAAS,eACd,cACA,UACA,SAMG;AACH,QAAM,OAAO;AAAA,IACX,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,GAAG;AAAA,EACL;AAEA,QAAM,OAAO,aAAa;AAC1B,MAAI,CAAC,QAAQ,CAAC,KAAK,aAAa;AAC9B,WAAO;AAAA,EACT;AAEA,QAAM,cAAc,KAAK;AACzB,QAAM,iBAAiB,YAAY;AAEnC,MAAI,OAAO,mBAAmB,YAAY;AACxC,WAAO;AAAA,EACT;AAEA,cAAY,SAAS,kBAAmB,MAAiB;AACvD,UAAM,SAAS,KAAK,CAAC;AAErB,QAAI,KAAK,cAAc,QAAQ,UAAU;AACvC,YAAM,WAAW,OAAO;AACxB,YAAM,eAAe,SAAS,OAAO,CAAC,MAAM,EAAE,SAAS,MAAM;AAC7D,YAAM,kBAAkB,aAAa,aAAa,SAAS,CAAC;AAE5D,UAAI,iBAAiB,SAAS;AAC5B,cAAM,SAAS,MAAM,SAAS,MAAM,gBAAgB,SAAS;AAAA,UAC3D,WAAW;AAAA,UACX,cAAc,KAAK;AAAA,QACrB,CAAC;AAED,YAAI,CAAC,OAAO,WAAW,KAAK,kBAAkB;AAC5C,gBAAM,IAAI;AAAA,YACR,kCAAkC,OAAO,WAAW,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,IAAI,CAAC;AAAA,YACnF,OAAO;AAAA,UACT;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,WAAO,eAAe,MAAM,MAAM,IAAI;AAAA,EACxC;AAEA,SAAO;AACT;","names":[]}
+{"version":3,"sources":["../src/openai-middleware.ts"],"sourcesContent":["/**\n * ComplyEdge OpenAI Middleware\n *\n * Wraps an OpenAI client to run compliance checks on messages\n * before they are sent to the model.\n *\n * Usage:\n *   import OpenAI from \"openai\";\n *   import { ComplyEdgeClient } from \"@complyedge/sdk\";\n *   import { withCompliance } from \"@complyedge/sdk/openai-middleware\";\n *\n *   const ce = new ComplyEdgeClient({ apiKey: \"...\" });\n *   const openai = withCompliance(new OpenAI(), ce);\n *   // Now openai.chat.completions.create() runs compliance checks automatically\n */\n\nimport type { ComplyEdgeClient } from \"./client\";\nimport type { ComplianceViolation } from \"./types\";\n\nexport class ComplianceError extends Error {\n  public violations: ComplianceViolation[];\n\n  constructor(message: string, violations: ComplianceViolation[]) {\n    super(message);\n    this.name = \"ComplianceError\";\n    this.violations = violations;\n  }\n}\n\n/**\n * Wrap an OpenAI client with ComplyEdge compliance checks.\n * The returned object proxies chat.completions.create() to check\n * user messages before sending to OpenAI.\n */\nexport function withCompliance<T extends Record<string, unknown>>(\n  openaiClient: T,\n  ceClient: ComplyEdgeClient,\n  options?: {\n    checkInput?: boolean;\n    checkOutput?: boolean;\n    jurisdiction?: string;\n    blockOnViolation?: boolean;\n  }\n): T {\n  const opts = {\n    checkInput: true,\n    checkOutput: false,\n    blockOnViolation: true,\n    ...options,\n  };\n\n  const chat = openaiClient.chat as Record<string, unknown> | undefined;\n  if (!chat || !chat.completions) {\n    return openaiClient; // Not an OpenAI-shaped client, return as-is\n  }\n\n  const completions = chat.completions as Record<string, unknown>;\n  const originalCreate = completions.create as (...args: unknown[]) => Promise<unknown>;\n\n  if (typeof originalCreate !== \"function\") {\n    return openaiClient;\n  }\n\n  completions.create = async function (...args: unknown[]) {\n    const params = args[0] as Record<string, unknown> | undefined;\n\n    if (opts.checkInput && params?.messages) {\n      const messages = params.messages as Array<{ role: string; content: unknown }>;\n      // Check EVERY user turn, not just the last one. A violation in an earlier\n      // message is still sent to the model verbatim, so checking only the tail\n      // left the majority of a multi-turn conversation unenforced.\n      for (const message of messages) {\n        if (message.role !== \"user\") continue;\n        for (const text of extractText(message.content)) {\n          const result = await ceClient.check(text, {\n            direction: \"prompt\",\n            jurisdiction: opts.jurisdiction,\n          });\n          if (!result.allowed && opts.blockOnViolation) {\n            throw new ComplianceError(\n              `Compliance violation detected: ${result.violations.map((v) => v.ruleId).join(\", \")}`,\n              result.violations\n            );\n          }\n        }\n      }\n    }\n\n    const response = await originalCreate.apply(this, args);\n\n    if (opts.checkOutput) {\n      // Previously declared in the options type and never read, so the README's\n      // \"runs compliance checks automatically\" was half true: inputs were\n      // checked, model output never was, silently.\n      for (const text of extractCompletionText(response)) {\n        const result = await ceClient.check(text, {\n          direction: \"output\",\n          jurisdiction: opts.jurisdiction,\n        });\n        if (!result.allowed && opts.blockOnViolation) {\n          throw new ComplianceError(\n            `Compliance violation in model output: ${result.violations.map((v) => v.ruleId).join(\", \")}`,\n            result.violations\n          );\n        }\n      }\n    }\n\n    return response;\n  };\n\n  return openaiClient;\n}\n\n/**\n * Pull checkable strings out of a message `content` field.\n *\n * OpenAI accepts either a plain string or an array of typed content parts.\n * The array form was previously passed to the API as a non-string and 422'd,\n * so multimodal callers could not use the middleware at all.\n */\nfunction extractText(content: unknown): string[] {\n  if (typeof content === \"string\") {\n    return content.trim() ? [content] : [];\n  }\n  if (Array.isArray(content)) {\n    return content\n      .map((part) => {\n        if (typeof part === \"string\") return part;\n        const p = part as Record<string, unknown> | null;\n        return p && typeof p.text === \"string\" ? p.text : \"\";\n      })\n      .filter((t) => t.trim().length > 0);\n  }\n  return [];\n}\n\n/** Pull assistant message text out of a chat completion response. */\nfunction extractCompletionText(response: unknown): string[] {\n  const r = response as { choices?: Array<{ message?: { content?: unknown } }> } | null;\n  if (!r?.choices) return [];\n  return r.choices.flatMap((choice) => extractText(choice?.message?.content));\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAmBO,IAAM,kBAAN,cAA8B,MAAM;AAAA,EAClC;AAAA,EAEP,YAAY,SAAiB,YAAmC;AAC9D,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,aAAa;AAAA,EACpB;AACF;AAOO,SAAS,eACd,cACA,UACA,SAMG;AACH,QAAM,OAAO;AAAA,IACX,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,GAAG;AAAA,EACL;AAEA,QAAM,OAAO,aAAa;AAC1B,MAAI,CAAC,QAAQ,CAAC,KAAK,aAAa;AAC9B,WAAO;AAAA,EACT;AAEA,QAAM,cAAc,KAAK;AACzB,QAAM,iBAAiB,YAAY;AAEnC,MAAI,OAAO,mBAAmB,YAAY;AACxC,WAAO;AAAA,EACT;AAEA,cAAY,SAAS,kBAAmB,MAAiB;AACvD,UAAM,SAAS,KAAK,CAAC;AAErB,QAAI,KAAK,cAAc,QAAQ,UAAU;AACvC,YAAM,WAAW,OAAO;AAIxB,iBAAW,WAAW,UAAU;AAC9B,YAAI,QAAQ,SAAS,OAAQ;AAC7B,mBAAW,QAAQ,YAAY,QAAQ,OAAO,GAAG;AAC/C,gBAAM,SAAS,MAAM,SAAS,MAAM,MAAM;AAAA,YACxC,WAAW;AAAA,YACX,cAAc,KAAK;AAAA,UACrB,CAAC;AACD,cAAI,CAAC,OAAO,WAAW,KAAK,kBAAkB;AAC5C,kBAAM,IAAI;AAAA,cACR,kCAAkC,OAAO,WAAW,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,IAAI,CAAC;AAAA,cACnF,OAAO;AAAA,YACT;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,UAAM,WAAW,MAAM,eAAe,MAAM,MAAM,IAAI;AAEtD,QAAI,KAAK,aAAa;AAIpB,iBAAW,QAAQ,sBAAsB,QAAQ,GAAG;AAClD,cAAM,SAAS,MAAM,SAAS,MAAM,MAAM;AAAA,UACxC,WAAW;AAAA,UACX,cAAc,KAAK;AAAA,QACrB,CAAC;AACD,YAAI,CAAC,OAAO,WAAW,KAAK,kBAAkB;AAC5C,gBAAM,IAAI;AAAA,YACR,yCAAyC,OAAO,WAAW,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,IAAI,CAAC;AAAA,YAC1F,OAAO;AAAA,UACT;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAEA,SAAO;AACT;AASA,SAAS,YAAY,SAA4B;AAC/C,MAAI,OAAO,YAAY,UAAU;AAC/B,WAAO,QAAQ,KAAK,IAAI,CAAC,OAAO,IAAI,CAAC;AAAA,EACvC;AACA,MAAI,MAAM,QAAQ,OAAO,GAAG;AAC1B,WAAO,QACJ,IAAI,CAAC,SAAS;AACb,UAAI,OAAO,SAAS,SAAU,QAAO;AACrC,YAAM,IAAI;AACV,aAAO,KAAK,OAAO,EAAE,SAAS,WAAW,EAAE,OAAO;AAAA,IACpD,CAAC,EACA,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,CAAC;AAAA,EACtC;AACA,SAAO,CAAC;AACV;AAGA,SAAS,sBAAsB,UAA6B;AAC1D,QAAM,IAAI;AACV,MAAI,CAAC,GAAG,QAAS,QAAO,CAAC;AACzB,SAAO,EAAE,QAAQ,QAAQ,CAAC,WAAW,YAAY,QAAQ,SAAS,OAAO,CAAC;AAC5E;","names":[]}

package/dist/openai-middleware.mjs

@@ -1,7 +1,7 @@
 import {
   ComplianceError,
   withCompliance
-} from "./chunk-KZYIMMVM.mjs";
+} from "./chunk-X7L22AQP.mjs";
 export {
   ComplianceError,
   withCompliance

package/package.json

@@ -1,14 +1,25 @@
 {
   "name": "@complyedge/sdk",
-  "version": "0.2.0",
-  "description": "TypeScript/JavaScript SDK for ComplyEdge runtime EU AI Act enforcement",
+  "version": "0.2.2",
+  "description": "EU AI Act runtime enforcement SDK: OPA/Rego policy checks, Article 12 audit trails, risk assessment, and OpenAI middleware.",
   "publishConfig": {
     "access": "public"
   },
   "keywords": [
+    "eu-ai-act",
+    "ai-act",
+    "ai-governance",
+    "ai-compliance",
     "compliance",
-    "ai",
-    "regulations",
+    "runtime-enforcement",
+    "guardrails",
+    "llm-security",
+    "opa",
+    "rego",
+    "audit-trail",
+    "article-12",
+    "risk-assessment",
+    "openai",
     "sdk",
     "typescript"
   ],
@@ -32,6 +43,7 @@
   "files": [
     "dist/**/*",
     "README.md",
+    "CHANGELOG.md",
     "LICENSE"
   ],
   "scripts": {
@@ -69,6 +81,10 @@
       "optional": true
     }
   },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/ComplyEdge/complyedge.git"
+  },
   "bugs": {
     "url": "https://github.com/ComplyEdge/complyedge/issues"
   },

package/dist/chunk-KZYIMMVM.mjs

@@ -1,54 +0,0 @@
-// src/openai-middleware.ts
-var ComplianceError = class extends Error {
-  violations;
-  constructor(message, violations) {
-    super(message);
-    this.name = "ComplianceError";
-    this.violations = violations;
-  }
-};
-function withCompliance(openaiClient, ceClient, options) {
-  const opts = {
-    checkInput: true,
-    checkOutput: false,
-    blockOnViolation: true,
-    ...options
-  };
-  const chat = openaiClient.chat;
-  if (!chat || !chat.completions) {
-    return openaiClient;
-  }
-  const completions = chat.completions;
-  const originalCreate = completions.create;
-  if (typeof originalCreate !== "function") {
-    return openaiClient;
-  }
-  completions.create = async function(...args) {
-    const params = args[0];
-    if (opts.checkInput && params?.messages) {
-      const messages = params.messages;
-      const userMessages = messages.filter((m) => m.role === "user");
-      const lastUserMessage = userMessages[userMessages.length - 1];
-      if (lastUserMessage?.content) {
-        const result = await ceClient.check(lastUserMessage.content, {
-          direction: "prompt",
-          jurisdiction: opts.jurisdiction
-        });
-        if (!result.allowed && opts.blockOnViolation) {
-          throw new ComplianceError(
-            `Compliance violation detected: ${result.violations.map((v) => v.ruleId).join(", ")}`,
-            result.violations
-          );
-        }
-      }
-    }
-    return originalCreate.apply(this, args);
-  };
-  return openaiClient;
-}
-
-export {
-  ComplianceError,
-  withCompliance
-};
-//# sourceMappingURL=chunk-KZYIMMVM.mjs.map

package/dist/chunk-KZYIMMVM.mjs.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/openai-middleware.ts"],"sourcesContent":["/**\n * ComplyEdge OpenAI Middleware\n *\n * Wraps an OpenAI client to run compliance checks on messages\n * before they are sent to the model.\n *\n * Usage:\n *   import OpenAI from \"openai\";\n *   import { ComplyEdgeClient } from \"@complyedge/sdk\";\n *   import { withCompliance } from \"@complyedge/sdk/openai-middleware\";\n *\n *   const ce = new ComplyEdgeClient({ apiKey: \"...\" });\n *   const openai = withCompliance(new OpenAI(), ce);\n *   // Now openai.chat.completions.create() runs compliance checks automatically\n */\n\nimport type { ComplyEdgeClient } from \"./client\";\nimport type { ComplianceViolation } from \"./types\";\n\nexport class ComplianceError extends Error {\n  public violations: ComplianceViolation[];\n\n  constructor(message: string, violations: ComplianceViolation[]) {\n    super(message);\n    this.name = \"ComplianceError\";\n    this.violations = violations;\n  }\n}\n\n/**\n * Wrap an OpenAI client with ComplyEdge compliance checks.\n * The returned object proxies chat.completions.create() to check\n * user messages before sending to OpenAI.\n */\nexport function withCompliance<T extends Record<string, unknown>>(\n  openaiClient: T,\n  ceClient: ComplyEdgeClient,\n  options?: {\n    checkInput?: boolean;\n    checkOutput?: boolean;\n    jurisdiction?: string;\n    blockOnViolation?: boolean;\n  }\n): T {\n  const opts = {\n    checkInput: true,\n    checkOutput: false,\n    blockOnViolation: true,\n    ...options,\n  };\n\n  const chat = openaiClient.chat as Record<string, unknown> | undefined;\n  if (!chat || !chat.completions) {\n    return openaiClient; // Not an OpenAI-shaped client, return as-is\n  }\n\n  const completions = chat.completions as Record<string, unknown>;\n  const originalCreate = completions.create as (...args: unknown[]) => Promise<unknown>;\n\n  if (typeof originalCreate !== \"function\") {\n    return openaiClient;\n  }\n\n  completions.create = async function (...args: unknown[]) {\n    const params = args[0] as Record<string, unknown> | undefined;\n\n    if (opts.checkInput && params?.messages) {\n      const messages = params.messages as Array<{ role: string; content: string }>;\n      const userMessages = messages.filter((m) => m.role === \"user\");\n      const lastUserMessage = userMessages[userMessages.length - 1];\n\n      if (lastUserMessage?.content) {\n        const result = await ceClient.check(lastUserMessage.content, {\n          direction: \"prompt\",\n          jurisdiction: opts.jurisdiction,\n        });\n\n        if (!result.allowed && opts.blockOnViolation) {\n          throw new ComplianceError(\n            `Compliance violation detected: ${result.violations.map((v) => v.ruleId).join(\", \")}`,\n            result.violations\n          );\n        }\n      }\n    }\n\n    return originalCreate.apply(this, args);\n  };\n\n  return openaiClient;\n}\n"],"mappings":";AAmBO,IAAM,kBAAN,cAA8B,MAAM;AAAA,EAClC;AAAA,EAEP,YAAY,SAAiB,YAAmC;AAC9D,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,aAAa;AAAA,EACpB;AACF;AAOO,SAAS,eACd,cACA,UACA,SAMG;AACH,QAAM,OAAO;AAAA,IACX,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,GAAG;AAAA,EACL;AAEA,QAAM,OAAO,aAAa;AAC1B,MAAI,CAAC,QAAQ,CAAC,KAAK,aAAa;AAC9B,WAAO;AAAA,EACT;AAEA,QAAM,cAAc,KAAK;AACzB,QAAM,iBAAiB,YAAY;AAEnC,MAAI,OAAO,mBAAmB,YAAY;AACxC,WAAO;AAAA,EACT;AAEA,cAAY,SAAS,kBAAmB,MAAiB;AACvD,UAAM,SAAS,KAAK,CAAC;AAErB,QAAI,KAAK,cAAc,QAAQ,UAAU;AACvC,YAAM,WAAW,OAAO;AACxB,YAAM,eAAe,SAAS,OAAO,CAAC,MAAM,EAAE,SAAS,MAAM;AAC7D,YAAM,kBAAkB,aAAa,aAAa,SAAS,CAAC;AAE5D,UAAI,iBAAiB,SAAS;AAC5B,cAAM,SAAS,MAAM,SAAS,MAAM,gBAAgB,SAAS;AAAA,UAC3D,WAAW;AAAA,UACX,cAAc,KAAK;AAAA,QACrB,CAAC;AAED,YAAI,CAAC,OAAO,WAAW,KAAK,kBAAkB;AAC5C,gBAAM,IAAI;AAAA,YACR,kCAAkC,OAAO,WAAW,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,IAAI,CAAC;AAAA,YACnF,OAAO;AAAA,UACT;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,WAAO,eAAe,MAAM,MAAM,IAAI;AAAA,EACxC;AAEA,SAAO;AACT;","names":[]}