@complyedge/sdk 0.2.1 → 0.2.3

package/CHANGELOG.md

@@ -0,0 +1,71 @@
+# Changelog
+
+All notable changes to `@complyedge/sdk` are documented here.
+
+The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and
+this package follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+**This record begins at 0.2.2.** Earlier releases shipped before the changelog
+existed; 0.2.1 is reconstructed from its commits, and anything not evidenced
+there is left out rather than guessed at.
+
+The Python SDK (`complyedge` on PyPI) is versioned independently. Version
+numbers are deliberately not kept level between the two — they are separate
+implementations with different capability surfaces, so matching numbers would
+imply a parity that does not exist.
+
+## [0.2.3] - 2026-08-20
+
+### Added
+- Package-map capability table (CE-vs-CE only): offline vs hosted, Rego/OPA,
+  Article 12, bundled corpus, ESM/CJS, MCP. Named competitor comparisons stay
+  gated — they need an explicit messaging decision against the no-first/only
+  doctrine.
+
+### Fixed
+- Release-path fact: publishes still use `NPM_TOKEN`. The 0.2.2 changelog
+  entry that claimed OIDC Trusted Publishing described an attempt that was
+  reverted (`repository.url` points at the public repo while workflows run in
+  the private platform). Provenance remains unavailable until that layout
+  changes (G1a).
+
+## [0.2.2] - 2026-08-20
+
+### Changed
+- Releases now publish through npm Trusted Publishing (OIDC). Each publish uses
+  a short-lived, workflow-scoped credential instead of a long-lived token, and
+  the token has been removed from the release workflow rather than left in place
+  as a fallback.
+
+### Added
+- This changelog.
+
+### Note
+- Provenance attestations are still not generated. npm produces them only when
+  publishing from a public repository, and the release workflow lives in a
+  private one. No package page claims provenance.
+
+## [0.2.1] - 2026-08-16
+
+### Added
+- `repository` field, which the package had never carried.
+- `Limitations and honest scope` section in the README — the SDK calls the
+  hosted API and is not an offline engine, a rule finding is technical evidence
+  rather than legal advice, and the OpenAI middleware is not a security sandbox.
+- Explicit note that the package works in both ESM and CommonJS projects.
+- Cross-links to `@complyedge/mcp`, `trustlint`, and the PyPI packages.
+
+### Changed
+- Description rewritten to name what the SDK actually does: OPA/Rego policy
+  checks, Article 12 audit trails, risk assessment, OpenAI middleware.
+- Keywords: 5 → 16, replacing generic terms with the ones a compliance buyer
+  searches. `opa` and `rego` are kept here because this package does call the
+  OPA hot path — they were removed from `trustlint`, which does not.
+
+## 0.2.0 and earlier
+
+Released before this changelog existed. See the repository history.
+
+[0.2.3]: https://www.npmjs.com/package/@complyedge/sdk/v/0.2.3
+[0.2.2]: https://www.npmjs.com/package/@complyedge/sdk/v/0.2.2
+[0.2.1]: https://www.npmjs.com/package/@complyedge/sdk/v/0.2.1

package/README.md

@@ -22,8 +22,21 @@ The SDK works in both ESM and CommonJS projects; no bundler-specific setup is re
 
 - [`@complyedge/mcp`](https://www.npmjs.com/package/@complyedge/mcp) runs the local, offline TrustLint MCP tools with `npx`.
 - [`trustlint`](https://www.npmjs.com/package/trustlint) is the local Node.js CLI for offline rule checks.
+- [`complyedge` on PyPI](https://pypi.org/project/complyedge/) is the Python SDK with the same enforcement API.
 - [Documentation](https://www.complyedge.io/docs) covers the hosted API; the [trust portal](https://trust.complyedge.io) covers security and reliability information.
 
+| | `@complyedge/sdk` | `trustlint` | `@complyedge/mcp` |
+|---|:-:|:-:|:-:|
+| Runs offline, no API key | ✗ | ✓ | ✓ |
+| Rego / OPA evaluation | ✓ | ✗ | ✗ |
+| Article 12 audit trail | ✓ | ✗ | ✗ |
+| Bundled 64-rule corpus | ✗ | ✓ | ✓ |
+| Temporal / effective-date rules | ✗ | ✗ | ✗ |
+| ESM + CommonJS | ✓ | ✓ | ESM only |
+| MCP host integration | ✗ | ✗ | ✓ |
+
+Temporal / effective-date evaluation lives in the Python engine only. A shared version number across npm and PyPI is not a parity claim.
+
 ## Version policy
 
 The TypeScript SDK and Python `complyedge` package have independent semantic versions. A version number does not imply feature parity across languages; each release documents and tests its own supported API surface.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@complyedge/sdk",
-  "version": "0.2.1",
+  "version": "0.2.3",
   "description": "EU AI Act runtime enforcement SDK: OPA/Rego policy checks, Article 12 audit trails, risk assessment, and OpenAI middleware.",
   "publishConfig": {
     "access": "public"
@@ -43,6 +43,7 @@
   "files": [
     "dist/**/*",
     "README.md",
+    "CHANGELOG.md",
     "LICENSE"
   ],
   "scripts": {