@complior/engine 0.9.0

package/src/data/registry-cards.ts

@@ -0,0 +1,368 @@
+/** Расширение EU AI Act assessment для LLM-моделей (pending SaaS adoption) */
+export interface EuAiActModelAssessment {
+  readonly risk_level?: string;
+  readonly risk_reasoning?: string;
+  readonly applicable_obligation_ids?: readonly string[];
+  readonly confidence?: string;
+  // Расширения для LLM-моделей (нет в SaaS пока):
+  readonly training_cutoff?: string;
+  readonly license?: string;
+  readonly gpai_compliant?: boolean | null;
+  readonly eu_representative?: string | null;
+  readonly limitations?: readonly string[];
+  readonly known_risks?: readonly string[];
+}
+
+/**
+ * CLI-представление карточки AI-системы из реестра.
+ * Структурно совместим с SaaS RegistryTool (PROJECT/frontend/lib/registry.ts).
+ * Опущены DB-поля: registryToolId, seo, active, createdAt, updatedAt.
+ */
+export interface RegistryToolCard {
+  readonly slug: string;
+  readonly name: string;
+  readonly provider: { readonly name: string; readonly website?: string };
+  readonly description: string | null;
+  readonly category: string | null;
+  readonly riskLevel: string | null;
+  readonly aiActRole: string | null;
+  readonly level: 'classified' | 'scanned' | 'verified';
+  readonly assessments: {
+    readonly 'eu-ai-act'?: EuAiActModelAssessment;
+  } | null;
+  readonly detectionPatterns: {
+    readonly code?: Readonly<Record<string, string | readonly string[]>>;
+  } | null;
+  readonly evidence: readonly {
+    readonly date: string;
+    readonly title: string;
+    readonly type?: string;
+  }[] | null;
+  readonly capabilities: readonly string[] | null;
+  readonly jurisdictions: readonly string[] | null;
+  readonly vendorCountry: string | null;
+  readonly dataResidency: string | null;
+}
+
+export const REGISTRY_CARDS: readonly RegistryToolCard[] = Object.freeze([
+  {
+    slug: 'gpt-4o',
+    name: 'GPT-4o',
+    provider: { name: 'OpenAI', website: 'https://openai.com/policies' },
+    description: 'Multimodal GPT model with vision, text, and code capabilities',
+    category: 'api_platform',
+    riskLevel: 'gpai_systemic',
+    aiActRole: 'provider',
+    level: 'classified',
+    assessments: {
+      'eu-ai-act': {
+        risk_level: 'gpai_systemic',
+        risk_reasoning: 'GPAI model per Art.51. Systemic risk classification likely. No EU representative disclosed',
+        applicable_obligation_ids: ['OBL-026'],
+        confidence: 'medium',
+        training_cutoff: '2024-10',
+        license: 'proprietary',
+        gpai_compliant: null,
+        eu_representative: null,
+        limitations: ['hallucination risk', 'no real-time data', 'context window limit'],
+        known_risks: ['bias in training data', 'prompt injection susceptibility', 'overconfident outputs'],
+      },
+    },
+    detectionPatterns: { code: { npm: ['openai'], pip: ['openai'] } },
+    evidence: null,
+    capabilities: ['text generation', 'code generation', 'multimodal (vision)', 'function calling', 'reasoning'],
+    jurisdictions: ['US'],
+    vendorCountry: 'US',
+    dataResidency: 'US',
+  },
+  {
+    slug: 'gpt-4o-mini',
+    name: 'GPT-4o Mini',
+    provider: { name: 'OpenAI', website: 'https://openai.com/policies' },
+    description: 'Lightweight GPT model for cost-efficient text and code tasks',
+    category: 'api_platform',
+    riskLevel: 'gpai',
+    aiActRole: 'provider',
+    level: 'classified',
+    assessments: {
+      'eu-ai-act': {
+        risk_level: 'gpai',
+        risk_reasoning: 'GPAI model per Art.51. Below systemic risk threshold',
+        applicable_obligation_ids: ['OBL-026'],
+        confidence: 'medium',
+        training_cutoff: '2024-10',
+        license: 'proprietary',
+        gpai_compliant: null,
+        eu_representative: null,
+        limitations: ['reduced reasoning vs GPT-4o', 'hallucination risk'],
+        known_risks: ['bias in training data', 'prompt injection susceptibility'],
+      },
+    },
+    detectionPatterns: { code: { npm: ['openai'], pip: ['openai'] } },
+    evidence: null,
+    capabilities: ['text generation', 'code generation', 'function calling'],
+    jurisdictions: ['US'],
+    vendorCountry: 'US',
+    dataResidency: 'US',
+  },
+  {
+    slug: 'o1',
+    name: 'OpenAI o1',
+    provider: { name: 'OpenAI', website: 'https://openai.com/policies' },
+    description: 'Advanced reasoning model with multi-step problem solving',
+    category: 'api_platform',
+    riskLevel: 'gpai_systemic',
+    aiActRole: 'provider',
+    level: 'classified',
+    assessments: {
+      'eu-ai-act': {
+        risk_level: 'gpai_systemic',
+        risk_reasoning: 'GPAI model per Art.51. Systemic risk due to advanced reasoning capabilities',
+        applicable_obligation_ids: ['OBL-026'],
+        confidence: 'medium',
+        training_cutoff: '2024-10',
+        license: 'proprietary',
+        gpai_compliant: null,
+        eu_representative: null,
+        limitations: ['high latency', 'higher cost', 'no streaming in reasoning phase'],
+        known_risks: ['chain-of-thought manipulation', 'overconfident reasoning', 'training data bias'],
+      },
+    },
+    detectionPatterns: { code: { npm: ['openai'], pip: ['openai'] } },
+    evidence: null,
+    capabilities: ['advanced reasoning', 'multi-step problem solving', 'code generation', 'math'],
+    jurisdictions: ['US'],
+    vendorCountry: 'US',
+    dataResidency: 'US',
+  },
+  {
+    slug: 'claude-opus-4',
+    name: 'Claude Opus 4',
+    provider: { name: 'Anthropic', website: 'https://www.anthropic.com/policies' },
+    description: 'Frontier model with extended thinking and Constitutional AI alignment',
+    category: 'api_platform',
+    riskLevel: 'gpai_systemic',
+    aiActRole: 'provider',
+    level: 'classified',
+    assessments: {
+      'eu-ai-act': {
+        risk_level: 'gpai_systemic',
+        risk_reasoning: 'GPAI model per Art.51. Constitutional AI alignment approach. Systemic risk classification likely',
+        applicable_obligation_ids: ['OBL-026'],
+        confidence: 'medium',
+        training_cutoff: '2025-03',
+        license: 'proprietary',
+        gpai_compliant: null,
+        eu_representative: null,
+        limitations: ['no real-time data', 'context window limit', 'no internet access'],
+        known_risks: ['hallucination risk', 'training data bias', 'sycophancy tendency'],
+      },
+    },
+    detectionPatterns: { code: { npm: ['@anthropic-ai/sdk'], pip: ['anthropic'] } },
+    evidence: null,
+    capabilities: ['text generation', 'code generation', 'analysis', 'multimodal (vision)', 'extended thinking'],
+    jurisdictions: ['US'],
+    vendorCountry: 'US',
+    dataResidency: 'US',
+  },
+  {
+    slug: 'claude-sonnet-4',
+    name: 'Claude Sonnet 4',
+    provider: { name: 'Anthropic', website: 'https://www.anthropic.com/policies' },
+    description: 'Balanced model for text, code, and multimodal analysis',
+    category: 'api_platform',
+    riskLevel: 'gpai',
+    aiActRole: 'provider',
+    level: 'classified',
+    assessments: {
+      'eu-ai-act': {
+        risk_level: 'gpai',
+        risk_reasoning: 'GPAI model per Art.51. Below systemic risk threshold',
+        applicable_obligation_ids: ['OBL-026'],
+        confidence: 'medium',
+        training_cutoff: '2025-03',
+        license: 'proprietary',
+        gpai_compliant: null,
+        eu_representative: null,
+        limitations: ['reduced capability vs Opus', 'no real-time data'],
+        known_risks: ['hallucination risk', 'training data bias'],
+      },
+    },
+    detectionPatterns: { code: { npm: ['@anthropic-ai/sdk'], pip: ['anthropic'] } },
+    evidence: null,
+    capabilities: ['text generation', 'code generation', 'analysis', 'multimodal (vision)'],
+    jurisdictions: ['US'],
+    vendorCountry: 'US',
+    dataResidency: 'US',
+  },
+  {
+    slug: 'gemini-2.0-flash',
+    name: 'Gemini 2.0 Flash',
+    provider: { name: 'Google', website: 'https://ai.google/responsibility/principles/' },
+    description: 'Fast multimodal model optimized for low-latency tasks',
+    category: 'api_platform',
+    riskLevel: 'gpai',
+    aiActRole: 'provider',
+    level: 'classified',
+    assessments: {
+      'eu-ai-act': {
+        risk_level: 'gpai',
+        risk_reasoning: 'GPAI model per Art.51. EU data residency option available',
+        applicable_obligation_ids: ['OBL-026'],
+        confidence: 'medium',
+        training_cutoff: '2024-08',
+        license: 'proprietary',
+        gpai_compliant: null,
+        eu_representative: 'Google Ireland Limited',
+        limitations: ['lower accuracy on complex tasks', 'hallucination risk'],
+        known_risks: ['training data bias', 'geographic bias in knowledge'],
+      },
+    },
+    detectionPatterns: { code: { npm: ['@google/generative-ai'], pip: ['google-generativeai'] } },
+    evidence: null,
+    capabilities: ['text generation', 'multimodal', 'code generation', 'function calling'],
+    jurisdictions: ['US', 'EU'],
+    vendorCountry: 'US',
+    dataResidency: 'US',
+  },
+  {
+    slug: 'gemini-2.0-pro',
+    name: 'Gemini 2.0 Pro',
+    provider: { name: 'Google', website: 'https://ai.google/responsibility/principles/' },
+    description: 'High-capability multimodal model with reasoning and code generation',
+    category: 'api_platform',
+    riskLevel: 'gpai_systemic',
+    aiActRole: 'provider',
+    level: 'classified',
+    assessments: {
+      'eu-ai-act': {
+        risk_level: 'gpai_systemic',
+        risk_reasoning: 'GPAI model per Art.51. Systemic risk classification likely. EU data residency option available',
+        applicable_obligation_ids: ['OBL-026'],
+        confidence: 'medium',
+        training_cutoff: '2024-08',
+        license: 'proprietary',
+        gpai_compliant: null,
+        eu_representative: 'Google Ireland Limited',
+        limitations: ['hallucination risk', 'high cost'],
+        known_risks: ['training data bias', 'geographic bias', 'overconfident outputs'],
+      },
+    },
+    detectionPatterns: { code: { npm: ['@google/generative-ai'], pip: ['google-generativeai'] } },
+    evidence: null,
+    capabilities: ['text generation', 'multimodal', 'code generation', 'reasoning', 'function calling'],
+    jurisdictions: ['US', 'EU'],
+    vendorCountry: 'US',
+    dataResidency: 'US',
+  },
+  {
+    slug: 'mistral-large',
+    name: 'Mistral Large',
+    provider: { name: 'Mistral AI', website: 'https://mistral.ai/terms/' },
+    description: 'Large multilingual model from EU-headquartered provider',
+    category: 'api_platform',
+    riskLevel: 'gpai',
+    aiActRole: 'provider',
+    level: 'classified',
+    assessments: {
+      'eu-ai-act': {
+        risk_level: 'gpai',
+        risk_reasoning: 'EU-headquartered provider. GPAI model per Art.51. EU data residency by default',
+        applicable_obligation_ids: ['OBL-026'],
+        confidence: 'medium',
+        training_cutoff: '2024-11',
+        license: 'proprietary',
+        gpai_compliant: null,
+        eu_representative: 'Mistral AI (Paris, France)',
+        limitations: ['smaller knowledge base', 'less tested than GPT-4/Claude'],
+        known_risks: ['training data bias', 'limited safety testing disclosure'],
+      },
+    },
+    detectionPatterns: { code: { npm: ['@mistralai/mistralai'], pip: ['mistralai'] } },
+    evidence: null,
+    capabilities: ['text generation', 'code generation', 'multilingual', 'function calling'],
+    jurisdictions: ['EU', 'US'],
+    vendorCountry: 'FR',
+    dataResidency: 'EU',
+  },
+  {
+    slug: 'mistral-small',
+    name: 'Mistral Small',
+    provider: { name: 'Mistral AI', website: 'https://mistral.ai/terms/' },
+    description: 'Compact multilingual model for efficient text and code tasks',
+    category: 'api_platform',
+    riskLevel: 'gpai',
+    aiActRole: 'provider',
+    level: 'classified',
+    assessments: {
+      'eu-ai-act': {
+        risk_level: 'gpai',
+        risk_reasoning: 'EU-headquartered provider. Below systemic risk threshold',
+        applicable_obligation_ids: ['OBL-026'],
+        confidence: 'medium',
+        training_cutoff: '2024-11',
+        license: 'proprietary',
+        gpai_compliant: null,
+        eu_representative: 'Mistral AI (Paris, France)',
+        limitations: ['reduced capability vs Large', 'limited reasoning'],
+        known_risks: ['training data bias'],
+      },
+    },
+    detectionPatterns: { code: { npm: ['@mistralai/mistralai'], pip: ['mistralai'] } },
+    evidence: null,
+    capabilities: ['text generation', 'code generation', 'multilingual'],
+    jurisdictions: ['EU', 'US'],
+    vendorCountry: 'FR',
+    dataResidency: 'EU',
+  },
+  {
+    slug: 'llama-3',
+    name: 'Llama 3',
+    provider: { name: 'Meta', website: 'https://llama.meta.com/' },
+    description: 'Open-weight model for self-hosted text and code generation',
+    category: 'api_platform',
+    riskLevel: 'gpai',
+    aiActRole: 'provider',
+    level: 'classified',
+    assessments: {
+      'eu-ai-act': {
+        risk_level: 'gpai',
+        risk_reasoning: 'Open-weight model. Deployer assumes GPAI obligations if modified. Art.53(2) open-source exemption may apply',
+        applicable_obligation_ids: ['OBL-026'],
+        confidence: 'low',
+        training_cutoff: '2024-03',
+        license: 'llama-community',
+        gpai_compliant: null,
+        eu_representative: null,
+        limitations: ['no multimodal', 'requires self-hosting or third-party provider', 'limited function calling'],
+        known_risks: ['training data bias', 'deployer responsible for safety guardrails', 'no built-in content filtering'],
+      },
+    },
+    detectionPatterns: { code: { pip: ['llama-cpp-python', 'transformers'] } },
+    evidence: null,
+    capabilities: ['text generation', 'code generation', 'multilingual', 'on-premise deployment'],
+    jurisdictions: ['self-hosted'],
+    vendorCountry: 'US',
+    dataResidency: null,
+  },
+] as const);
+
+export const findRegistryCard = (slug: string): RegistryToolCard | undefined =>
+  REGISTRY_CARDS.find((c) => c.slug === slug);
+
+export const findRegistryCardsByProvider = (providerName: string): readonly RegistryToolCard[] =>
+  REGISTRY_CARDS.filter((c) => c.provider.name.toLowerCase() === providerName.toLowerCase());
+
+/** Regex matching all known model slugs. Longest-first to avoid partial matches (e.g. gpt-4o vs gpt-4o-mini). */
+export const REGISTRY_SLUG_PATTERN = new RegExp(
+  `\\b(?:${[...REGISTRY_CARDS].sort((a, b) => b.slug.length - a.slug.length || a.slug.localeCompare(b.slug)).map((c) => c.slug.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')).join('|')})\\b`,
+  'g',
+);
+
+/** Check if a card is classified as GPAI with systemic risk. */
+export const isGpaiSystemic = (card: RegistryToolCard): boolean =>
+  card.riskLevel === 'gpai_systemic';
+
+/** Get the provider name from a card. */
+export const getProviderName = (card: RegistryToolCard): string =>
+  card.provider.name;

package/src/data/regulation/index.ts

@@ -0,0 +1,5 @@
+export { REGULATION_RAW } from './regulation-data.js';
+export { loadRegulationData, clearRegulationCache } from './regulation-loader.js';
+export type { RegulationData } from './regulation-loader.js';
+export { listJurisdictions, getJurisdiction, JurisdictionSchema } from './jurisdiction-data.js';
+export type { Jurisdiction } from './jurisdiction-data.js';

package/src/data/regulation/jurisdiction-data.test.ts

@@ -0,0 +1,73 @@
+import { describe, it, expect } from 'vitest';
+import { listJurisdictions, getJurisdiction, JurisdictionSchema } from './jurisdiction-data.js';
+
+describe('jurisdiction-data', () => {
+  it('lists all 30 jurisdictions', () => {
+    const jurisdictions = listJurisdictions();
+    expect(jurisdictions.length).toBe(30);
+  });
+
+  it('all jurisdictions validate against schema', () => {
+    for (const j of listJurisdictions()) {
+      const result = JurisdictionSchema.safeParse(j);
+      expect(result.success, `Failed for ${j.country_code}: ${JSON.stringify(result.error?.issues)}`).toBe(true);
+    }
+  });
+
+  it('getJurisdiction returns correct country', () => {
+    const de = getJurisdiction('de');
+    expect(de).toBeDefined();
+    expect(de!.country_name).toBe('Germany');
+    expect(de!.msa_name).toContain('Bundesnetzagentur');
+  });
+
+  it('getJurisdiction is case-insensitive', () => {
+    expect(getJurisdiction('DE')).toBeDefined();
+    expect(getJurisdiction('de')).toBeDefined();
+    expect(getJurisdiction('De')).toBeDefined();
+  });
+
+  it('getJurisdiction returns undefined for invalid code', () => {
+    expect(getJurisdiction('xx')).toBeUndefined();
+    expect(getJurisdiction('us')).toBeUndefined();
+  });
+
+  it('all country codes are unique', () => {
+    const codes = listJurisdictions().map(j => j.country_code);
+    expect(new Set(codes).size).toBe(30);
+  });
+
+  it('all countries have non-empty local_requirements', () => {
+    for (const j of listJurisdictions()) {
+      expect(j.local_requirements.length, `${j.country_code} has no local_requirements`).toBeGreaterThan(0);
+    }
+  });
+
+  it('all countries have valid enforcement_date format', () => {
+    for (const j of listJurisdictions()) {
+      expect(j.enforcement_date).toMatch(/^\d{4}-\d{2}-\d{2}$/);
+    }
+  });
+
+  it('EEA countries (IS, LI, NO) are included', () => {
+    expect(getJurisdiction('is')).toBeDefined();
+    expect(getJurisdiction('li')).toBeDefined();
+    expect(getJurisdiction('no')).toBeDefined();
+  });
+
+  it('France has CNIL as MSA', () => {
+    const fr = getJurisdiction('fr')!;
+    expect(fr.msa_name).toContain('CNIL');
+  });
+
+  it('Spain has AESIA as MSA', () => {
+    const es = getJurisdiction('es')!;
+    expect(es.msa_name).toContain('AESIA');
+  });
+
+  it('each jurisdiction has an msa_url starting with https', () => {
+    for (const j of listJurisdictions()) {
+      expect(j.msa_url, `${j.country_code} msa_url`).toMatch(/^https:\/\//);
+    }
+  });
+});

package/src/data/regulation/jurisdiction-data.ts

@@ -0,0 +1,65 @@
+import { z } from 'zod';
+
+export const JurisdictionSchema = z.object({
+  country_code: z.string().length(2),
+  country_name: z.string(),
+  msa_name: z.string(),
+  msa_url: z.string().url(),
+  msa_contact: z.string(),
+  local_requirements: z.array(z.string()),
+  enforcement_date: z.string(),
+  language: z.string(),
+  notes: z.string().optional(),
+});
+
+export type Jurisdiction = z.infer<typeof JurisdictionSchema>;
+
+// Import all 30 jurisdiction JSON files at compile time
+import atData from '../../../data/regulations/jurisdictions/at.json' with { type: 'json' };
+import beData from '../../../data/regulations/jurisdictions/be.json' with { type: 'json' };
+import bgData from '../../../data/regulations/jurisdictions/bg.json' with { type: 'json' };
+import hrData from '../../../data/regulations/jurisdictions/hr.json' with { type: 'json' };
+import cyData from '../../../data/regulations/jurisdictions/cy.json' with { type: 'json' };
+import czData from '../../../data/regulations/jurisdictions/cz.json' with { type: 'json' };
+import dkData from '../../../data/regulations/jurisdictions/dk.json' with { type: 'json' };
+import eeData from '../../../data/regulations/jurisdictions/ee.json' with { type: 'json' };
+import fiData from '../../../data/regulations/jurisdictions/fi.json' with { type: 'json' };
+import frData from '../../../data/regulations/jurisdictions/fr.json' with { type: 'json' };
+import deData from '../../../data/regulations/jurisdictions/de.json' with { type: 'json' };
+import grData from '../../../data/regulations/jurisdictions/gr.json' with { type: 'json' };
+import huData from '../../../data/regulations/jurisdictions/hu.json' with { type: 'json' };
+import ieData from '../../../data/regulations/jurisdictions/ie.json' with { type: 'json' };
+import itData from '../../../data/regulations/jurisdictions/it.json' with { type: 'json' };
+import lvData from '../../../data/regulations/jurisdictions/lv.json' with { type: 'json' };
+import ltData from '../../../data/regulations/jurisdictions/lt.json' with { type: 'json' };
+import luData from '../../../data/regulations/jurisdictions/lu.json' with { type: 'json' };
+import mtData from '../../../data/regulations/jurisdictions/mt.json' with { type: 'json' };
+import nlData from '../../../data/regulations/jurisdictions/nl.json' with { type: 'json' };
+import plData from '../../../data/regulations/jurisdictions/pl.json' with { type: 'json' };
+import ptData from '../../../data/regulations/jurisdictions/pt.json' with { type: 'json' };
+import roData from '../../../data/regulations/jurisdictions/ro.json' with { type: 'json' };
+import skData from '../../../data/regulations/jurisdictions/sk.json' with { type: 'json' };
+import siData from '../../../data/regulations/jurisdictions/si.json' with { type: 'json' };
+import esData from '../../../data/regulations/jurisdictions/es.json' with { type: 'json' };
+import seData from '../../../data/regulations/jurisdictions/se.json' with { type: 'json' };
+import isData from '../../../data/regulations/jurisdictions/is.json' with { type: 'json' };
+import liData from '../../../data/regulations/jurisdictions/li.json' with { type: 'json' };
+import noData from '../../../data/regulations/jurisdictions/no.json' with { type: 'json' };
+
+const RAW_DATA = [
+  atData, beData, bgData, hrData, cyData, czData, dkData, eeData, fiData, frData,
+  deData, grData, huData, ieData, itData, lvData, ltData, luData, mtData, nlData,
+  plData, ptData, roData, skData, siData, esData, seData, isData, liData, noData,
+];
+
+const ALL_JURISDICTIONS: readonly Jurisdiction[] = RAW_DATA.map(d => JurisdictionSchema.parse(d));
+
+const jurisdictionMap = new Map<string, Jurisdiction>(
+  ALL_JURISDICTIONS.map(j => [j.country_code.toLowerCase(), j])
+);
+
+export const getJurisdiction = (code: string): Jurisdiction | undefined =>
+  jurisdictionMap.get(code.toLowerCase());
+
+export const listJurisdictions = (): readonly Jurisdiction[] =>
+  ALL_JURISDICTIONS;

package/src/data/regulation/regulation-data.ts

@@ -0,0 +1,19 @@
+import obligations from '../../../data/regulations/eu-ai-act/obligations.json' with { type: 'json' };
+import technicalRequirements from '../../../data/regulations/eu-ai-act/technical-requirements.json' with { type: 'json' };
+import scoring from '../../../data/regulations/eu-ai-act/scoring.json' with { type: 'json' };
+import regulationMeta from '../../../data/regulations/eu-ai-act/regulation-meta.json' with { type: 'json' };
+import applicabilityTree from '../../../data/regulations/eu-ai-act/applicability-tree.json' with { type: 'json' };
+import crossMapping from '../../../data/regulations/eu-ai-act/cross-mapping.json' with { type: 'json' };
+import localization from '../../../data/regulations/eu-ai-act/localization.json' with { type: 'json' };
+import timeline from '../../../data/regulations/eu-ai-act/timeline.json' with { type: 'json' };
+
+export const REGULATION_RAW = {
+  obligations,
+  technicalRequirements,
+  scoring,
+  regulationMeta,
+  applicabilityTree,
+  crossMapping,
+  localization,
+  timeline,
+} as const;

package/src/data/regulation/regulation-loader.test.ts

@@ -0,0 +1,107 @@
+import { describe, it, expect, beforeEach } from 'vitest';
+import { loadRegulationData, clearRegulationCache } from './regulation-loader.js';
+
+describe('RegulationLoader', () => {
+  beforeEach(() => {
+    clearRegulationCache();
+  });
+
+  it('should load all 8 regulation files successfully', async () => {
+    const data = await loadRegulationData();
+
+    expect(data.obligations).toBeDefined();
+    expect(data.technicalRequirements).toBeDefined();
+    expect(data.scoring).toBeDefined();
+    expect(data.regulationMeta).toBeDefined();
+    expect(data.applicabilityTree).toBeDefined();
+    expect(data.crossMapping).toBeDefined();
+    expect(data.localization).toBeDefined();
+    expect(data.timeline).toBeDefined();
+  });
+
+  it('should validate obligations schema', async () => {
+    const data = await loadRegulationData();
+
+    expect(data.obligations._version).toBe('2.0');
+    expect(data.obligations.obligations.length).toBeGreaterThan(0);
+
+    const firstObligation = data.obligations.obligations[0];
+    expect(firstObligation?.obligation_id).toMatch(/^eu-ai-act-OBL-/);
+    expect(firstObligation?.article_reference).toBeDefined();
+    expect(firstObligation?.title).toBeDefined();
+    expect(firstObligation?.severity).toBeDefined();
+    expect(firstObligation?.applies_to_risk_level).toBeInstanceOf(Array);
+  });
+
+  it('should validate scoring schema', async () => {
+    const data = await loadRegulationData();
+    const scoring = data.scoring.scoring;
+
+    expect(scoring.regulation_id).toBe('eu-ai-act');
+    expect(scoring.total_obligations).toBeGreaterThan(0);
+    expect(scoring.critical_obligation_ids.length).toBeGreaterThan(0);
+    expect(scoring.weighted_categories.length).toBeGreaterThan(0);
+    expect(scoring.thresholds.red).toBeDefined();
+    expect(scoring.thresholds.yellow).toBeDefined();
+    expect(scoring.thresholds.green).toBeDefined();
+
+    const totalWeight = scoring.weighted_categories.reduce((sum, c) => sum + c.weight, 0);
+    expect(totalWeight).toBe(100);
+  });
+
+  it('should validate technical-requirements schema', async () => {
+    const data = await loadRegulationData();
+
+    expect(data.technicalRequirements._version).toBe('2.0');
+    expect(data.technicalRequirements.technical_requirements.length).toBeGreaterThan(0);
+
+    const first = data.technicalRequirements.technical_requirements[0];
+    expect(first?.obligation_id).toMatch(/^eu-ai-act-OBL-/);
+    expect(first?.feature_type).toBeDefined();
+  });
+
+  it('should validate regulation-meta schema', async () => {
+    const data = await loadRegulationData();
+    const meta = data.regulationMeta.stage_1_metadata;
+
+    expect(meta.regulation_id).toBe('eu-ai-act');
+    expect(meta.status).toBe('in-force');
+    expect(meta.extraterritorial).toBe(true);
+    expect(meta.risk_levels.length).toBeGreaterThan(0);
+    expect(data.regulationMeta.stage_2_role_mapping.roles.length).toBeGreaterThan(0);
+    expect(data.regulationMeta.stage_3_risk_classification.levels.length).toBeGreaterThan(0);
+  });
+
+  it('should validate applicability-tree schema', async () => {
+    const data = await loadRegulationData();
+    const tree = data.applicabilityTree.applicability_tree;
+
+    expect(tree.regulation_id).toBe('eu-ai-act');
+    expect(tree.root_question).toBe('Q1');
+    expect(tree.questions.length).toBeGreaterThan(0);
+  });
+
+  it('should validate timeline schema', async () => {
+    const data = await loadRegulationData();
+    const timeline = data.timeline.timeline;
+
+    expect(timeline.regulation_id).toBe('eu-ai-act');
+    expect(timeline.key_dates.length).toBeGreaterThan(0);
+    expect(timeline.expected_amendments.length).toBeGreaterThan(0);
+  });
+
+  it('should return cached data on second call', async () => {
+    const data1 = await loadRegulationData();
+    const data2 = await loadRegulationData();
+
+    expect(data1).toBe(data2);
+  });
+
+  it('should load within 500ms', async () => {
+    const start = performance.now();
+    await loadRegulationData();
+    const duration = performance.now() - start;
+
+    expect(duration).toBeLessThan(500);
+  });
+});