@complior/engine 0.9.0

package/src/domain/scanner/cross-layer.test.ts

@@ -0,0 +1,372 @@
+import { describe, it, expect } from 'vitest';
+import { runCrossLayerChecks, crossLayerToCheckResults, CROSS_LAYER_RULES } from './cross-layer.js';
+import type { CheckResult } from '../../types/common.types.js';
+import type { L2CheckResult } from './layers/layer2-docs.js';
+import type { L3CheckResult } from './layers/layer3-config.js';
+import type { L4CheckResult } from './layers/layer4-patterns.js';
+
+const makeL1Pass = (checkId: string): CheckResult => ({
+  type: 'pass',
+  checkId,
+  message: `${checkId} found`,
+});
+
+const makeL1Fail = (checkId: string): CheckResult => ({
+  type: 'fail',
+  checkId,
+  message: `${checkId} missing`,
+  severity: 'medium',
+});
+
+const makeL2 = (overrides: Partial<L2CheckResult> = {}): L2CheckResult => ({
+  obligationId: 'eu-ai-act-OBL-011',
+  article: 'Art. 26',
+  document: 'monitoring-policy',
+  status: 'VALID',
+  foundSections: ['Monitoring Scope'],
+  missingSections: [],
+  totalRequired: 1,
+  matchedRequired: 1,
+  ...overrides,
+});
+
+const makeL3 = (overrides: Partial<L3CheckResult> = {}): L3CheckResult => ({
+  type: 'ai-sdk-detected',
+  status: 'OK',
+  message: 'AI SDK detected: OpenAI',
+  packageName: 'openai',
+  ecosystem: 'npm',
+  ...overrides,
+});
+
+const makeL4 = (overrides: Partial<L4CheckResult> = {}): L4CheckResult => ({
+  obligationId: 'eu-ai-act-OBL-015',
+  article: 'Art. 50(1)',
+  category: 'disclosure',
+  patternType: 'positive',
+  status: 'FOUND',
+  matchedPattern: 'AI disclosure component',
+  recommendation: 'Add disclosure',
+  ...overrides,
+});
+
+describe('CROSS_LAYER_RULES', () => {
+  it('has 6 rules defined', () => {
+    expect(CROSS_LAYER_RULES).toHaveLength(6);
+  });
+
+  it('all rules have id and description', () => {
+    for (const rule of CROSS_LAYER_RULES) {
+      expect(rule.id).toBeTruthy();
+      expect(rule.description).toBeTruthy();
+    }
+  });
+});
+
+describe('cross-doc-code-mismatch', () => {
+  it('fires when monitoring doc exists but no monitoring code', () => {
+    const findings = runCrossLayerChecks(
+      [],
+      [makeL2({ document: 'monitoring-policy', status: 'VALID' })],
+      [],
+      [], // No monitoring code
+    );
+
+    const mismatch = findings.find((f) => f.ruleId === 'cross-doc-code-mismatch');
+    expect(mismatch).toBeDefined();
+    expect(mismatch?.severity).toBe('medium');
+  });
+
+  it('does not fire when monitoring doc and code both present', () => {
+    const findings = runCrossLayerChecks(
+      [],
+      [makeL2({ document: 'monitoring-policy', status: 'VALID' })],
+      [],
+      [makeL4({ category: 'deployer-monitoring', status: 'FOUND' })],
+    );
+
+    const mismatch = findings.find((f) => f.ruleId === 'cross-doc-code-mismatch');
+    expect(mismatch).toBeUndefined();
+  });
+
+  it('does not fire when no monitoring doc', () => {
+    const findings = runCrossLayerChecks([], [], [], []);
+    const mismatch = findings.find((f) => f.ruleId === 'cross-doc-code-mismatch');
+    expect(mismatch).toBeUndefined();
+  });
+
+  it('fires for SHALLOW monitoring docs too', () => {
+    const findings = runCrossLayerChecks(
+      [],
+      [makeL2({ document: 'monitoring-policy', status: 'SHALLOW' })],
+      [],
+      [],
+    );
+
+    const mismatch = findings.find((f) => f.ruleId === 'cross-doc-code-mismatch');
+    expect(mismatch).toBeDefined();
+  });
+});
+
+describe('cross-banned-with-wrapper', () => {
+  it('fires when banned package has compliance controls', () => {
+    const findings = runCrossLayerChecks(
+      [],
+      [],
+      [makeL3({ type: 'banned-package', status: 'PROHIBITED' })],
+      [makeL4({ category: 'disclosure', status: 'FOUND' })],
+    );
+
+    const wrapped = findings.find((f) => f.ruleId === 'cross-banned-with-wrapper');
+    expect(wrapped).toBeDefined();
+    expect(wrapped?.severity).toBe('medium');
+  });
+
+  it('does not fire when banned package has no controls', () => {
+    const findings = runCrossLayerChecks(
+      [],
+      [],
+      [makeL3({ type: 'banned-package', status: 'PROHIBITED' })],
+      [],
+    );
+
+    const wrapped = findings.find((f) => f.ruleId === 'cross-banned-with-wrapper');
+    expect(wrapped).toBeUndefined();
+  });
+
+  it('fires for human-oversight control too', () => {
+    const findings = runCrossLayerChecks(
+      [],
+      [],
+      [makeL3({ type: 'banned-package', status: 'PROHIBITED' })],
+      [makeL4({ category: 'human-oversight', status: 'FOUND' })],
+    );
+
+    const wrapped = findings.find((f) => f.ruleId === 'cross-banned-with-wrapper');
+    expect(wrapped).toBeDefined();
+  });
+});
+
+describe('cross-logging-no-retention', () => {
+  it('fires when logging in code but no retention config', () => {
+    const findings = runCrossLayerChecks(
+      [],
+      [],
+      [makeL3({ type: 'log-retention', status: 'WARNING' })],
+      [makeL4({ category: 'logging', status: 'FOUND' })],
+    );
+
+    const noRetention = findings.find((f) => f.ruleId === 'cross-logging-no-retention');
+    expect(noRetention).toBeDefined();
+    expect(noRetention?.article).toBe('Art. 12');
+  });
+
+  it('does not fire when retention config is OK', () => {
+    const findings = runCrossLayerChecks(
+      [],
+      [],
+      [makeL3({ type: 'log-retention', status: 'OK' })],
+      [makeL4({ category: 'logging', status: 'FOUND' })],
+    );
+
+    const noRetention = findings.find((f) => f.ruleId === 'cross-logging-no-retention');
+    expect(noRetention).toBeUndefined();
+  });
+
+  it('does not fire when no logging code', () => {
+    const findings = runCrossLayerChecks([], [], [], []);
+    const noRetention = findings.find((f) => f.ruleId === 'cross-logging-no-retention');
+    expect(noRetention).toBeUndefined();
+  });
+});
+
+describe('cross-kill-switch-no-test', () => {
+  it('fires when kill switch found but no test file in context', () => {
+    const ctx = {
+      projectPath: '/test',
+      files: [
+        { relativePath: 'src/kill-switch.ts', content: '', extension: '.ts' },
+      ],
+    };
+    const findings = runCrossLayerChecks(
+      [makeL1Fail('documentation')],
+      [],
+      [],
+      [makeL4({ category: 'kill-switch', status: 'FOUND' })],
+      ctx,
+    );
+
+    const noTest = findings.find((f) => f.ruleId === 'cross-kill-switch-no-test');
+    expect(noTest).toBeDefined();
+    expect(noTest?.severity).toBe('low');
+  });
+
+  it('does not fire when kill-switch test file exists in context', () => {
+    const ctx = {
+      projectPath: '/test',
+      files: [
+        { relativePath: 'src/kill-switch.ts', content: '', extension: '.ts' },
+        { relativePath: 'src/kill-switch.test.ts', content: '', extension: '.ts' },
+      ],
+    };
+    const findings = runCrossLayerChecks(
+      [],
+      [],
+      [],
+      [makeL4({ category: 'kill-switch', status: 'FOUND' })],
+      ctx,
+    );
+
+    const noTest = findings.find((f) => f.ruleId === 'cross-kill-switch-no-test');
+    expect(noTest).toBeUndefined();
+  });
+
+  it('fires when no context provided', () => {
+    const findings = runCrossLayerChecks(
+      [],
+      [],
+      [],
+      [makeL4({ category: 'kill-switch', status: 'FOUND' })],
+    );
+
+    const noTest = findings.find((f) => f.ruleId === 'cross-kill-switch-no-test');
+    expect(noTest).toBeDefined();
+  });
+});
+
+describe('cross-passport-code-mismatch', () => {
+  it('fires when passport exists + AI SDK in deps but no disclosure', () => {
+    const findings = runCrossLayerChecks(
+      [makeL1Pass('passport-presence')],
+      [],
+      [makeL3({ type: 'ai-sdk-detected' })],
+      [], // No disclosure
+    );
+
+    const mismatch = findings.find((f) => f.ruleId === 'cross-passport-code-mismatch');
+    expect(mismatch).toBeDefined();
+    expect(mismatch?.severity).toBe('medium');
+    expect(mismatch?.article).toBe('Art. 50(1)');
+  });
+
+  it('does not fire when passport exists and disclosure present', () => {
+    const findings = runCrossLayerChecks(
+      [makeL1Pass('passport-presence')],
+      [],
+      [makeL3({ type: 'ai-sdk-detected' })],
+      [makeL4({ category: 'disclosure', status: 'FOUND' })],
+    );
+
+    const mismatch = findings.find((f) => f.ruleId === 'cross-passport-code-mismatch');
+    expect(mismatch).toBeUndefined();
+  });
+
+  it('does not fire when no passport exists', () => {
+    const findings = runCrossLayerChecks(
+      [makeL1Fail('passport-presence')],
+      [],
+      [makeL3({ type: 'ai-sdk-detected' })],
+      [],
+    );
+
+    const mismatch = findings.find((f) => f.ruleId === 'cross-passport-code-mismatch');
+    expect(mismatch).toBeUndefined();
+  });
+});
+
+describe('cross-permission-passport-mismatch', () => {
+  it('fires when undeclared-permission fail exists', () => {
+    const findings = runCrossLayerChecks(
+      [
+        makeL1Fail('undeclared-permission'),
+        makeL1Fail('undeclared-permission'),
+      ],
+      [],
+      [],
+      [],
+    );
+
+    const mismatch = findings.find((f) => f.ruleId === 'cross-permission-passport-mismatch');
+    expect(mismatch).toBeDefined();
+    expect(mismatch?.severity).toBe('high');
+    expect(mismatch?.description).toContain('2 undeclared');
+  });
+
+  it('does not fire when no undeclared permissions', () => {
+    const findings = runCrossLayerChecks(
+      [makeL1Pass('passport-presence')],
+      [],
+      [],
+      [],
+    );
+
+    const mismatch = findings.find((f) => f.ruleId === 'cross-permission-passport-mismatch');
+    expect(mismatch).toBeUndefined();
+  });
+});
+
+describe('runCrossLayerChecks', () => {
+  it('returns empty for fully compliant project', () => {
+    const findings = runCrossLayerChecks(
+      [makeL1Pass('test-suite')],
+      [makeL2({ document: 'monitoring-policy', status: 'VALID' })],
+      [
+        makeL3({ type: 'ai-sdk-detected' }),
+        makeL3({ type: 'log-retention', status: 'OK' }),
+      ],
+      [
+        makeL4({ category: 'disclosure', status: 'FOUND' }),
+        makeL4({ category: 'deployer-monitoring', status: 'FOUND' }),
+        makeL4({ category: 'logging', status: 'FOUND' }),
+      ],
+    );
+
+    // No cross-layer issues when all layers are aligned
+    expect(findings).toHaveLength(0);
+  });
+
+  it('can return multiple findings', () => {
+    const findings = runCrossLayerChecks(
+      [makeL1Fail('undeclared-permission')],
+      [makeL2({ document: 'monitoring-policy', status: 'VALID' })],
+      [],
+      [makeL4({ category: 'logging', status: 'FOUND' })],
+    );
+
+    // Should fire at least: doc-code-mismatch + permission-passport-mismatch
+    expect(findings.length).toBeGreaterThanOrEqual(2);
+  });
+});
+
+describe('crossLayerToCheckResults', () => {
+  it('converts findings to fail CheckResults', () => {
+    const findings = runCrossLayerChecks(
+      [makeL1Fail('undeclared-permission')],
+      [],
+      [],
+      [],
+    );
+
+    const checkResults = crossLayerToCheckResults(findings);
+    expect(checkResults.length).toBeGreaterThan(0);
+    expect(checkResults.every((r) => r.type === 'fail')).toBe(true);
+  });
+
+  it('preserves severity and article', () => {
+    const checkResults = crossLayerToCheckResults([{
+      ruleId: 'test-rule',
+      description: 'Test finding',
+      severity: 'high',
+      layers: ['L3', 'L4'],
+      obligationId: 'eu-ai-act-OBL-015',
+      article: 'Art. 50(1)',
+    }]);
+
+    expect(checkResults).toHaveLength(1);
+    if (checkResults[0].type === 'fail') {
+      expect(checkResults[0].severity).toBe('high');
+      expect(checkResults[0].articleReference).toBe('Art. 50(1)');
+      expect(checkResults[0].obligationId).toBe('eu-ai-act-OBL-015');
+    }
+  });
+});

package/src/domain/scanner/cross-layer.ts

@@ -0,0 +1,232 @@
+import type { CheckResult } from '../../types/common.types.js';
+import type { ScanContext } from '../../ports/scanner.port.js';
+import type { L2CheckResult } from './layers/layer2-docs.js';
+import type { L3CheckResult } from './layers/layer3-config.js';
+import type { L4CheckResult } from './layers/layer4-patterns.js';
+
+export interface CrossLayerFinding {
+  readonly ruleId: string;
+  readonly description: string;
+  readonly severity: 'critical' | 'high' | 'medium' | 'low';
+  readonly layers: readonly string[];
+  readonly obligationId?: string;
+  readonly article?: string;
+}
+
+export interface CrossLayerRule {
+  readonly id: string;
+  readonly description: string;
+  readonly check: (
+    l1Results: readonly CheckResult[],
+    l2Results: readonly L2CheckResult[],
+    l3Results: readonly L3CheckResult[],
+    l4Results: readonly L4CheckResult[],
+    ctx?: ScanContext,
+  ) => readonly CrossLayerFinding[];
+}
+
+// Rule 1: Document says monitoring exists but no monitoring code found
+const docCodeMismatch: CrossLayerRule = {
+  id: 'cross-doc-code-mismatch',
+  description: 'Document claims monitoring but L4 finds no monitoring patterns',
+  check: (_l1, l2Results, _l3, l4Results) => {
+    const findings: CrossLayerFinding[] = [];
+
+    const hasMonitoringDoc = l2Results.some(
+      (r) => r.document === 'monitoring-policy' && (r.status === 'VALID' || r.status === 'SHALLOW'),
+    );
+    const hasMonitoringCode = l4Results.some(
+      (r) => r.category === 'deployer-monitoring' && r.status === 'FOUND',
+    );
+
+    if (hasMonitoringDoc && !hasMonitoringCode) {
+      findings.push({
+        ruleId: 'cross-doc-code-mismatch',
+        description: 'Monitoring policy document exists but no monitoring patterns found in code. Document may be aspirational.',
+        severity: 'medium',
+        layers: ['L2', 'L4'],
+        obligationId: 'eu-ai-act-OBL-011',
+        article: 'Art. 26(5)',
+      });
+    }
+
+    return findings;
+  },
+};
+
+// Rule 3: Banned package detected but wrapped with compliance layer → reduce severity
+const bannedWithWrapper: CrossLayerRule = {
+  id: 'cross-banned-with-wrapper',
+  description: 'Banned package found but compliance wrapper detected — severity may be reduced',
+  check: (_l1, _l2, l3Results, l4Results) => {
+    const findings: CrossLayerFinding[] = [];
+
+    const hasBanned = l3Results.some((r) => r.type === 'banned-package');
+    const hasCompliance = l4Results.some(
+      (r) =>
+        (r.category === 'disclosure' || r.category === 'human-oversight' || r.category === 'kill-switch') &&
+        r.status === 'FOUND',
+    );
+
+    if (hasBanned && hasCompliance) {
+      findings.push({
+        ruleId: 'cross-banned-with-wrapper',
+        description: 'Prohibited package detected but compliance controls (disclosure, oversight, kill-switch) are present. Review whether usage falls under an Art. 5 exception.',
+        severity: 'medium',
+        layers: ['L3', 'L4'],
+        article: 'Art. 5',
+      });
+    }
+
+    return findings;
+  },
+};
+
+// Rule 4: Logging found in code but no log retention config
+const loggingNoRetention: CrossLayerRule = {
+  id: 'cross-logging-no-retention',
+  description: 'Logging patterns found in code but no log retention configuration in infra',
+  check: (_l1, _l2, l3Results, l4Results) => {
+    const findings: CrossLayerFinding[] = [];
+
+    const hasLoggingCode = l4Results.some(
+      (r) => r.category === 'logging' && r.status === 'FOUND',
+    );
+    const hasRetentionConfig = l3Results.some(
+      (r) => r.type === 'log-retention' && r.status === 'OK',
+    );
+
+    if (hasLoggingCode && !hasRetentionConfig) {
+      findings.push({
+        ruleId: 'cross-logging-no-retention',
+        description: 'AI logging implemented in code but no log retention configuration found. Art. 12 requires log retention >= 180 days.',
+        severity: 'medium',
+        layers: ['L3', 'L4'],
+        obligationId: 'eu-ai-act-OBL-006',
+        article: 'Art. 12',
+      });
+    }
+
+    return findings;
+  },
+};
+
+// Rule 5: Kill switch found but no test files → untested safety mechanism
+const killSwitchWithoutTest: CrossLayerRule = {
+  id: 'cross-kill-switch-no-test',
+  description: 'Kill switch pattern found but no test files detected',
+  check: (_l1, _l2, _l3, l4Results, ctx) => {
+    const findings: CrossLayerFinding[] = [];
+
+    const hasKillSwitch = l4Results.some(
+      (r) => r.category === 'kill-switch' && r.status === 'FOUND',
+    );
+    const hasTestFiles = ctx !== undefined && ctx.files.some(
+      (f) => /kill.?switch/i.test(f.relativePath) && /\.(test|spec)\./i.test(f.relativePath),
+    );
+
+    if (hasKillSwitch && !hasTestFiles) {
+      findings.push({
+        ruleId: 'cross-kill-switch-no-test',
+        description: 'AI kill switch pattern found in code but no automated tests detected for it. Safety mechanisms should be tested.',
+        severity: 'low',
+        layers: ['L1', 'L4'],
+        article: 'Art. 14',
+      });
+    }
+
+    return findings;
+  },
+};
+
+// Rule 6: AI SDK in deps but no disclosure pattern
+const passportCodeMismatch: CrossLayerRule = {
+  id: 'cross-passport-code-mismatch',
+  description: 'AI SDK in dependencies but no disclosure pattern in code',
+  check: (l1Results, _l2, l3Results, l4Results) => {
+    const findings: CrossLayerFinding[] = [];
+
+    // Check if passport exists (L1 passport-presence pass)
+    const hasPassport = l1Results.some(
+      (r) => r.type === 'pass' && r.checkId === 'passport-presence',
+    );
+
+    if (!hasPassport) return findings;
+
+    // AI SDK in dependencies (L3) but no disclosure pattern (L4)
+    const hasAiSdk = l3Results.some((r) => r.type === 'ai-sdk-detected');
+    const hasDisclosure = l4Results.some(
+      (r) => r.category === 'disclosure' && r.status === 'FOUND',
+    );
+
+    if (hasAiSdk && !hasDisclosure) {
+      findings.push({
+        ruleId: 'cross-passport-code-mismatch',
+        description: 'AI SDK in dependencies but no disclosure pattern found — ensure Art. 50(1) transparency requirements are met.',
+        severity: 'medium',
+        layers: ['L1', 'L3', 'L4'],
+        obligationId: 'eu-ai-act-OBL-015',
+        article: 'Art. 50(1)',
+      });
+    }
+
+    return findings;
+  },
+};
+
+// Rule 7: Undeclared permissions — governance failure
+const permissionPassportMismatch: CrossLayerRule = {
+  id: 'cross-permission-passport-mismatch',
+  description: 'Undeclared permissions in passport — governance gap per Art. 26(4)',
+  check: (l1Results, _l2, _l3, _l4Results) => {
+    const undeclaredCount = l1Results.filter(
+      (r) => r.type === 'fail' && r.checkId === 'undeclared-permission',
+    ).length;
+
+    if (undeclaredCount === 0) return [];
+
+    return [{
+      ruleId: 'cross-permission-passport-mismatch',
+      description: `${undeclaredCount} undeclared permission(s) in passport — governance gap per Art. 26(4)`,
+      severity: 'high',
+      layers: ['L1'],
+      obligationId: 'eu-ai-act-OBL-011',
+      article: 'Art. 26(4)',
+    }];
+  },
+};
+
+export const CROSS_LAYER_RULES: readonly CrossLayerRule[] = [
+  docCodeMismatch,
+  bannedWithWrapper,
+  loggingNoRetention,
+  killSwitchWithoutTest,
+  passportCodeMismatch,
+  permissionPassportMismatch,
+];
+
+export const runCrossLayerChecks = (
+  l1Results: readonly CheckResult[],
+  l2Results: readonly L2CheckResult[],
+  l3Results: readonly L3CheckResult[],
+  l4Results: readonly L4CheckResult[],
+  ctx?: ScanContext,
+): readonly CrossLayerFinding[] => {
+  const allFindings: CrossLayerFinding[] = [];
+
+  for (const rule of CROSS_LAYER_RULES) {
+    allFindings.push(...rule.check(l1Results, l2Results, l3Results, l4Results, ctx));
+  }
+
+  return allFindings;
+};
+
+export const crossLayerToCheckResults = (findings: readonly CrossLayerFinding[]): readonly CheckResult[] =>
+  findings.map((f): CheckResult => ({
+    type: 'fail',
+    checkId: f.ruleId,
+    message: f.description,
+    severity: f.severity,
+    obligationId: f.obligationId,
+    articleReference: f.article,
+  }));

package/src/domain/scanner/data/ai-packages.ts

@@ -0,0 +1,82 @@
+/**
+ * Central AI SDK package registry.
+ * Single source of truth for AI package detection across all language ecosystems.
+ * NOTE: banned-packages.ts stays separate — different purpose (Art. 5 prohibition patterns).
+ */
+
+export interface AiPackageEntry {
+  readonly name: string;
+  readonly ecosystem: 'npm' | 'pypi' | 'go' | 'rust' | 'java';
+}
+
+const AI_PACKAGE_REGISTRY: readonly AiPackageEntry[] = [
+  // npm (JS/TS)
+  { name: 'openai', ecosystem: 'npm' },
+  { name: '@anthropic-ai/sdk', ecosystem: 'npm' },
+  { name: '@google/generative-ai', ecosystem: 'npm' },
+  { name: '@ai-sdk/openai', ecosystem: 'npm' },
+  { name: '@ai-sdk/anthropic', ecosystem: 'npm' },
+  { name: '@ai-sdk/google', ecosystem: 'npm' },
+  { name: '@ai-sdk/core', ecosystem: 'npm' },
+  { name: 'langchain', ecosystem: 'npm' },
+  { name: '@langchain/core', ecosystem: 'npm' },
+  { name: '@langchain/openai', ecosystem: 'npm' },
+  { name: '@langchain/anthropic', ecosystem: 'npm' },
+  { name: 'cohere-ai', ecosystem: 'npm' },
+  { name: '@mistralai/mistralai', ecosystem: 'npm' },
+  { name: '@huggingface/inference', ecosystem: 'npm' },
+  { name: 'replicate', ecosystem: 'npm' },
+  { name: 'together-ai', ecosystem: 'npm' },
+  { name: '@complior/sdk', ecosystem: 'npm' },
+
+  // PyPI (Python)
+  { name: 'anthropic', ecosystem: 'pypi' },
+  { name: 'google.generativeai', ecosystem: 'pypi' },
+  { name: 'cohere', ecosystem: 'pypi' },
+  { name: 'mistralai', ecosystem: 'pypi' },
+  { name: 'huggingface_hub', ecosystem: 'pypi' },
+  { name: 'transformers', ecosystem: 'pypi' },
+  { name: 'torch', ecosystem: 'pypi' },
+  { name: 'tensorflow', ecosystem: 'pypi' },
+  { name: 'keras', ecosystem: 'pypi' },
+
+  // Go
+  { name: 'github.com/sashabaranov/go-openai', ecosystem: 'go' },
+  { name: 'github.com/anthropics/anthropic-sdk-go', ecosystem: 'go' },
+  { name: 'cloud.google.com/go/ai/generativelanguage', ecosystem: 'go' },
+  { name: 'github.com/tmc/langchaingo', ecosystem: 'go' },
+  { name: 'github.com/cohere-ai/cohere-go', ecosystem: 'go' },
+
+  // Rust
+  { name: 'async-openai', ecosystem: 'rust' },
+  { name: 'anthropic', ecosystem: 'rust' },
+  { name: 'google-generative-ai', ecosystem: 'rust' },
+  { name: 'llm', ecosystem: 'rust' },
+  { name: 'candle-core', ecosystem: 'rust' },
+  { name: 'tch', ecosystem: 'rust' },
+  { name: 'rust-bert', ecosystem: 'rust' },
+  { name: 'langchain-rust', ecosystem: 'rust' },
+
+  // Java
+  { name: 'dev.langchain4j', ecosystem: 'java' },
+  { name: 'com.theokanning.openai-gpt3-java', ecosystem: 'java' },
+  { name: 'com.google.cloud.aiplatform', ecosystem: 'java' },
+  { name: 'ai.djl', ecosystem: 'java' },
+  { name: 'org.deeplearning4j', ecosystem: 'java' },
+  { name: 'com.azure.ai.openai', ecosystem: 'java' },
+];
+
+const byEcosystem = (eco: AiPackageEntry['ecosystem']): ReadonlySet<string> =>
+  new Set(AI_PACKAGE_REGISTRY.filter((p) => p.ecosystem === eco).map((p) => p.name));
+
+/** npm + PyPI packages (used by import-graph for JS/TS/Python import detection). */
+export const NPM_AI_PACKAGES: ReadonlySet<string> = byEcosystem('npm');
+export const PIP_AI_PACKAGES: ReadonlySet<string> = byEcosystem('pypi');
+
+/** Combined npm + PyPI set (backward-compatible with old AI_PACKAGES). */
+export const AI_PACKAGES: ReadonlySet<string> = new Set([...NPM_AI_PACKAGES, ...PIP_AI_PACKAGES]);
+
+/** Language-specific sets (used by language adapters). */
+export const GO_AI_PACKAGES: ReadonlySet<string> = byEcosystem('go');
+export const RUST_AI_PACKAGES: ReadonlySet<string> = byEcosystem('rust');
+export const JAVA_AI_PACKAGES: ReadonlySet<string> = byEcosystem('java');