One SDK call. Production-ready code with built-in security review, type safety, and a verifiable compliance trace. Generate, review, refactor, debug — five methods, one API key.
import Composite from '@compositellm/sdk'
const composite = new Composite({
apiKey: process.env.COMPOSITE_API_KEY,
})
const { code, complianceTrace } =
await composite.code.generate({
task: 'Build a REST API with auth',
language: 'typescript',
compliance: ['owasp-top-10', 'soc2'],
})
console.log(complianceTrace.rulesEnforced)
// ['no-eval', 'parameterized-queries',
// 'secrets-redacted', 'auth-required']| Capability | You call | You ship |
|---|---|---|
| Generate | composite.code.generate({ task, language }) | Production code, linted, type-checked, security-reviewed. |
| Review | composite.code.review({ diff, rules }) | Inline PR comments, severity-graded, with fix suggestions. |
| Refactor | composite.code.refactor({ file, goal }) | Refactored code + diff explanation. |
| Debug | composite.code.debug({ error, context }) | Root cause + minimal patch. |
| Migrate | composite.code.migrate({ from, to, project }) | End-to-end migration plan + patches. |
Composite Code applies compliance frames during generation — not after. Every output ships with a verifiable trace of which rules were applied and which were enforced.
{
"requestId": "req_8c2a1f",
"capability": "generate",
"vertical": "code",
"rulesRequested": ["owasp-top-10", "soc2"],
"rulesEnforced": [
"no-eval",
"parameterized-queries",
"secrets-redacted",
"auth-required",
"rate-limit-applied"
],
"checks": {
"lint": "pass",
"typecheck": "pass",
"securityReview": "pass"
},
"latencyMs": 1840
}