@complior/engine 0.9.0

package/src/domain/scanner/role-filter.ts

@@ -0,0 +1,51 @@
+import type { Role, Finding } from '../../types/common.types.js';
+
+/**
+ * Static mapping: checkId → required role.
+ * Checks NOT listed here apply to 'both' (all roles).
+ */
+const CHECK_ROLE: ReadonlyMap<string, Role> = new Map([
+  // Provider-only (org builds AI system)
+  ['qms', 'provider'],
+  ['gpai-transparency', 'provider'],
+  ['gpai-systemic-risk', 'provider'],
+  ['l3-missing-bias-testing', 'provider'],
+  ['l4-data-governance', 'provider'],
+  ['l4-content-marking', 'provider'],
+  ['l4-gpai-transparency', 'provider'],
+  ['l4-conformity-assessment', 'provider'],
+  ['content-marking', 'provider'],
+
+  // Deployer-only (org uses AI system)
+  ['monitoring-policy', 'deployer'],
+  ['worker-notification', 'deployer'],
+  ['incident-report', 'deployer'],
+  ['fria', 'deployer'],
+  ['l4-deployer-monitoring', 'deployer'],
+  ['l4-record-keeping', 'deployer'],
+]);
+
+/** Get the required role for a check. Unlisted checks → 'both'. */
+export const getCheckRole = (checkId: string): Role =>
+  CHECK_ROLE.get(checkId) ?? 'both';
+
+/**
+ * Filter findings by project role.
+ * Findings for an inapplicable role become type: 'skip' (visible but not scored).
+ * If projectRole is 'both', all findings pass through unchanged.
+ */
+export const filterFindingsByRole = (
+  findings: readonly Finding[],
+  projectRole: Role,
+): readonly Finding[] => {
+  if (projectRole === 'both') return findings;
+  return findings.map(f => {
+    const role = getCheckRole(f.checkId);
+    if (role === 'both' || role === projectRole) return f;
+    return {
+      ...f,
+      type: 'skip' as const,
+      message: `Skipped: ${role}-only check (project role: ${projectRole})`,
+    };
+  });
+};

package/src/domain/scanner/rules/banned-packages-data.ts

@@ -0,0 +1,553 @@
+export interface BannedPackage {
+  readonly name: string;
+  readonly ecosystem: 'npm' | 'pip' | 'cargo' | 'go' | 'any';
+  readonly reason: string;
+  readonly obligationId: string;
+  readonly article: string;
+  readonly penalty: string;
+  readonly prohibitedWhen: string;
+  readonly verifyMessage: string;
+}
+
+export const BANNED_PACKAGES: readonly BannedPackage[] = [
+  // --- Art. 5(1)(a): Subliminal/manipulative/deceptive techniques ---
+  {
+    name: 'subliminal-ai',
+    ecosystem: 'any',
+    reason: 'Subliminal manipulation',
+    obligationId: 'eu-ai-act-OBL-002',
+    article: 'Art. 5(1)(a)',
+    penalty: '€35M or 7% turnover',
+    prohibitedWhen: 'Used as subliminal or manipulative technique to distort behavior beyond person\'s awareness, causing significant harm',
+    verifyMessage: 'Does this influence user decisions through techniques they are not aware of?',
+  },
+  {
+    name: 'dark-patterns',
+    ecosystem: 'npm',
+    reason: 'Deceptive design patterns',
+    obligationId: 'eu-ai-act-OBL-002',
+    article: 'Art. 5(1)(a)',
+    penalty: '€35M or 7% turnover',
+    prohibitedWhen: 'Used as subliminal or manipulative technique to distort behavior beyond person\'s awareness, causing significant harm',
+    verifyMessage: 'Does this influence user decisions through techniques they are not aware of?',
+  },
+  {
+    name: 'deceptive-design',
+    ecosystem: 'npm',
+    reason: 'Deceptive design toolkit',
+    obligationId: 'eu-ai-act-OBL-002',
+    article: 'Art. 5(1)(a)',
+    penalty: '€35M or 7% turnover',
+    prohibitedWhen: 'Used as subliminal or manipulative technique to distort behavior beyond person\'s awareness, causing significant harm',
+    verifyMessage: 'Does this influence user decisions through techniques they are not aware of?',
+  },
+  {
+    name: 'nudge-ai',
+    ecosystem: 'any',
+    reason: 'AI-based behavioral nudging',
+    obligationId: 'eu-ai-act-OBL-002',
+    article: 'Art. 5(1)(a)',
+    penalty: '€35M or 7% turnover',
+    prohibitedWhen: 'Used as subliminal or manipulative technique to distort behavior beyond person\'s awareness, causing significant harm',
+    verifyMessage: 'Does this influence user decisions through techniques they are not aware of?',
+  },
+  {
+    name: 'manipulative-ux',
+    ecosystem: 'npm',
+    reason: 'Manipulative UX patterns',
+    obligationId: 'eu-ai-act-OBL-002',
+    article: 'Art. 5(1)(a)',
+    penalty: '€35M or 7% turnover',
+    prohibitedWhen: 'Used as subliminal or manipulative technique to distort behavior beyond person\'s awareness, causing significant harm',
+    verifyMessage: 'Does this influence user decisions through techniques they are not aware of?',
+  },
+  {
+    name: 'subliminal-messaging',
+    ecosystem: 'any',
+    reason: 'Subliminal messaging toolkit',
+    obligationId: 'eu-ai-act-OBL-002',
+    article: 'Art. 5(1)(a)',
+    penalty: '€35M or 7% turnover',
+    prohibitedWhen: 'Used as subliminal or manipulative technique to distort behavior beyond person\'s awareness, causing significant harm',
+    verifyMessage: 'Does this influence user decisions through techniques they are not aware of?',
+  },
+
+  // --- Art. 5(1)(b): Exploitation of vulnerabilities ---
+  {
+    name: 'vulnerability-exploitation',
+    ecosystem: 'any',
+    reason: 'Exploits age/disability/social vulnerabilities',
+    obligationId: 'eu-ai-act-OBL-002',
+    article: 'Art. 5(1)(b)',
+    penalty: '€35M or 7% turnover',
+    prohibitedWhen: 'Exploits vulnerabilities due to age, disability, or social/economic situation to distort behavior, causing significant harm',
+    verifyMessage: 'Does this target or exploit vulnerable groups (children, elderly, disabled)?',
+  },
+
+  // --- Art. 5(1)(c): Social scoring ---
+  {
+    name: 'social-credit-score',
+    ecosystem: 'any',
+    reason: 'Social scoring',
+    obligationId: 'eu-ai-act-OBL-002',
+    article: 'Art. 5(1)(c)',
+    penalty: '€35M or 7% turnover',
+    prohibitedWhen: 'Evaluates or classifies persons based on social behavior or personal characteristics, leading to detrimental treatment unrelated to the original context',
+    verifyMessage: 'Does this aggregate personal behavior into a score that affects access to services?',
+  },
+  {
+    name: 'social-score',
+    ecosystem: 'any',
+    reason: 'Social behavior scoring',
+    obligationId: 'eu-ai-act-OBL-002',
+    article: 'Art. 5(1)(c)',
+    penalty: '€35M or 7% turnover',
+    prohibitedWhen: 'Evaluates or classifies persons based on social behavior or personal characteristics, leading to detrimental treatment unrelated to the original context',
+    verifyMessage: 'Does this aggregate personal behavior into a score that affects access to services?',
+  },
+  {
+    name: 'reputation-score',
+    ecosystem: 'any',
+    reason: 'Person reputation scoring',
+    obligationId: 'eu-ai-act-OBL-002',
+    article: 'Art. 5(1)(c)',
+    penalty: '€35M or 7% turnover',
+    prohibitedWhen: 'Evaluates or classifies persons based on social behavior or personal characteristics, leading to detrimental treatment unrelated to the original context',
+    verifyMessage: 'Does this aggregate personal behavior into a score that affects access to services?',
+  },
+  {
+    name: 'citizen-score',
+    ecosystem: 'any',
+    reason: 'Citizen scoring system',
+    obligationId: 'eu-ai-act-OBL-002',
+    article: 'Art. 5(1)(c)',
+    penalty: '€35M or 7% turnover',
+    prohibitedWhen: 'Evaluates or classifies persons based on social behavior or personal characteristics, leading to detrimental treatment unrelated to the original context',
+    verifyMessage: 'Does this aggregate personal behavior into a score that affects access to services?',
+  },
+  {
+    name: 'trust-score',
+    ecosystem: 'any',
+    reason: 'Social trust scoring',
+    obligationId: 'eu-ai-act-OBL-002',
+    article: 'Art. 5(1)(c)',
+    penalty: '€35M or 7% turnover',
+    prohibitedWhen: 'Evaluates or classifies persons based on social behavior or personal characteristics, leading to detrimental treatment unrelated to the original context',
+    verifyMessage: 'Does this aggregate personal behavior into a score that affects access to services?',
+  },
+  {
+    name: 'behavior-score',
+    ecosystem: 'any',
+    reason: 'Behavioral scoring of persons',
+    obligationId: 'eu-ai-act-OBL-002',
+    article: 'Art. 5(1)(c)',
+    penalty: '€35M or 7% turnover',
+    prohibitedWhen: 'Evaluates or classifies persons based on social behavior or personal characteristics, leading to detrimental treatment unrelated to the original context',
+    verifyMessage: 'Does this aggregate personal behavior into a score that affects access to services?',
+  },
+  {
+    name: 'credit-social',
+    ecosystem: 'any',
+    reason: 'Social credit scoring',
+    obligationId: 'eu-ai-act-OBL-002',
+    article: 'Art. 5(1)(c)',
+    penalty: '€35M or 7% turnover',
+    prohibitedWhen: 'Evaluates or classifies persons based on social behavior or personal characteristics, leading to detrimental treatment unrelated to the original context',
+    verifyMessage: 'Does this aggregate personal behavior into a score that affects access to services?',
+  },
+
+  // --- Art. 5(1)(d): Individual criminal risk prediction ---
+  {
+    name: 'predpol',
+    ecosystem: 'any',
+    reason: 'Predictive policing based on profiling',
+    obligationId: 'eu-ai-act-OBL-002',
+    article: 'Art. 5(1)(d)',
+    penalty: '€35M or 7% turnover',
+    prohibitedWhen: 'Assesses risk of criminal offence based solely on profiling or personality traits, without objective verifiable facts',
+    verifyMessage: 'Does this predict criminality based on personal characteristics rather than verified facts?',
+  },
+  {
+    name: 'predictive-policing',
+    ecosystem: 'any',
+    reason: 'Predictive policing',
+    obligationId: 'eu-ai-act-OBL-002',
+    article: 'Art. 5(1)(d)',
+    penalty: '€35M or 7% turnover',
+    prohibitedWhen: 'Assesses risk of criminal offence based solely on profiling or personality traits, without objective verifiable facts',
+    verifyMessage: 'Does this predict criminality based on personal characteristics rather than verified facts?',
+  },
+  {
+    name: 'crime-prediction',
+    ecosystem: 'any',
+    reason: 'Criminal risk prediction via profiling',
+    obligationId: 'eu-ai-act-OBL-002',
+    article: 'Art. 5(1)(d)',
+    penalty: '€35M or 7% turnover',
+    prohibitedWhen: 'Assesses risk of criminal offence based solely on profiling or personality traits, without objective verifiable facts',
+    verifyMessage: 'Does this predict criminality based on personal characteristics rather than verified facts?',
+  },
+  {
+    name: 'precrime',
+    ecosystem: 'any',
+    reason: 'Pre-crime risk assessment',
+    obligationId: 'eu-ai-act-OBL-002',
+    article: 'Art. 5(1)(d)',
+    penalty: '€35M or 7% turnover',
+    prohibitedWhen: 'Assesses risk of criminal offence based solely on profiling or personality traits, without objective verifiable facts',
+    verifyMessage: 'Does this predict criminality based on personal characteristics rather than verified facts?',
+  },
+  {
+    name: 'recidivism-predictor',
+    ecosystem: 'any',
+    reason: 'Recidivism prediction via profiling',
+    obligationId: 'eu-ai-act-OBL-002',
+    article: 'Art. 5(1)(d)',
+    penalty: '€35M or 7% turnover',
+    prohibitedWhen: 'Assesses risk of criminal offence based solely on profiling or personality traits, without objective verifiable facts',
+    verifyMessage: 'Does this predict criminality based on personal characteristics rather than verified facts?',
+  },
+
+  // --- Art. 5(1)(e): Untargeted facial scraping ---
+  {
+    name: 'clearview-ai',
+    ecosystem: 'any',
+    reason: 'Untargeted facial scraping from internet/CCTV',
+    obligationId: 'eu-ai-act-OBL-002',
+    article: 'Art. 5(1)(e)',
+    penalty: '€35M or 7% turnover',
+    prohibitedWhen: 'Creates or expands facial recognition databases through untargeted scraping from internet or CCTV footage',
+    verifyMessage: 'Does this collect facial images from public sources without individual consent?',
+  },
+  {
+    name: 'face-scraper',
+    ecosystem: 'any',
+    reason: 'Facial image scraping toolkit',
+    obligationId: 'eu-ai-act-OBL-002',
+    article: 'Art. 5(1)(e)',
+    penalty: '€35M or 7% turnover',
+    prohibitedWhen: 'Creates or expands facial recognition databases through untargeted scraping from internet or CCTV footage',
+    verifyMessage: 'Does this collect facial images from public sources without individual consent?',
+  },
+
+  // --- Art. 5(1)(f): Emotion recognition in workplace/education ---
+  {
+    name: 'deepface',
+    ecosystem: 'pip',
+    reason: 'Emotion recognition',
+    obligationId: 'eu-ai-act-OBL-002',
+    article: 'Art. 5(1)(f)',
+    penalty: '€35M or 7% turnover',
+    prohibitedWhen: 'Infers emotions in workplace or educational settings, except for medical or safety purposes',
+    verifyMessage: 'Is this used to detect emotions of employees or students? (Medical/safety use is exempt)',
+  },
+  {
+    name: 'fer',
+    ecosystem: 'pip',
+    reason: 'Facial Emotion Recognition',
+    obligationId: 'eu-ai-act-OBL-002',
+    article: 'Art. 5(1)(f)',
+    penalty: '€35M or 7% turnover',
+    prohibitedWhen: 'Infers emotions in workplace or educational settings, except for medical or safety purposes',
+    verifyMessage: 'Is this used to detect emotions of employees or students? (Medical/safety use is exempt)',
+  },
+  {
+    name: 'emotion-recognition',
+    ecosystem: 'npm',
+    reason: 'Emotion recognition',
+    obligationId: 'eu-ai-act-OBL-002',
+    article: 'Art. 5(1)(f)',
+    penalty: '€35M or 7% turnover',
+    prohibitedWhen: 'Infers emotions in workplace or educational settings, except for medical or safety purposes',
+    verifyMessage: 'Is this used to detect emotions of employees or students? (Medical/safety use is exempt)',
+  },
+  {
+    name: 'py-feat',
+    ecosystem: 'pip',
+    reason: 'Facial expression analysis (emotion recognition)',
+    obligationId: 'eu-ai-act-OBL-002',
+    article: 'Art. 5(1)(f)',
+    penalty: '€35M or 7% turnover',
+    prohibitedWhen: 'Infers emotions in workplace or educational settings, except for medical or safety purposes',
+    verifyMessage: 'Is this used to detect emotions of employees or students? (Medical/safety use is exempt)',
+  },
+  {
+    name: 'emopy',
+    ecosystem: 'pip',
+    reason: 'Emotion recognition from facial expressions',
+    obligationId: 'eu-ai-act-OBL-002',
+    article: 'Art. 5(1)(f)',
+    penalty: '€35M or 7% turnover',
+    prohibitedWhen: 'Infers emotions in workplace or educational settings, except for medical or safety purposes',
+    verifyMessage: 'Is this used to detect emotions of employees or students? (Medical/safety use is exempt)',
+  },
+  {
+    name: 'affectiva',
+    ecosystem: 'any',
+    reason: 'Emotion AI / affective computing',
+    obligationId: 'eu-ai-act-OBL-002',
+    article: 'Art. 5(1)(f)',
+    penalty: '€35M or 7% turnover',
+    prohibitedWhen: 'Infers emotions in workplace or educational settings, except for medical or safety purposes',
+    verifyMessage: 'Is this used to detect emotions of employees or students? (Medical/safety use is exempt)',
+  },
+  {
+    name: 'emotion-api',
+    ecosystem: 'any',
+    reason: 'Emotion detection API client',
+    obligationId: 'eu-ai-act-OBL-002',
+    article: 'Art. 5(1)(f)',
+    penalty: '€35M or 7% turnover',
+    prohibitedWhen: 'Infers emotions in workplace or educational settings, except for medical or safety purposes',
+    verifyMessage: 'Is this used to detect emotions of employees or students? (Medical/safety use is exempt)',
+  },
+
+  // --- Art. 5(1)(g): Biometric categorization by protected characteristics ---
+  {
+    name: 'face-api.js',
+    ecosystem: 'npm',
+    reason: 'Biometric identification / categorization',
+    obligationId: 'eu-ai-act-OBL-002',
+    article: 'Art. 5(1)(g)',
+    penalty: '€35M or 7% turnover',
+    prohibitedWhen: 'Categorizes persons by biometric data to infer race, political opinions, trade union membership, religious beliefs, sex life, or sexual orientation',
+    verifyMessage: 'Does this classify people by protected characteristics (race, religion, sexual orientation)?',
+  },
+  {
+    name: 'insightface',
+    ecosystem: 'pip',
+    reason: 'Biometric face analysis and categorization',
+    obligationId: 'eu-ai-act-OBL-002',
+    article: 'Art. 5(1)(g)',
+    penalty: '€35M or 7% turnover',
+    prohibitedWhen: 'Categorizes persons by biometric data to infer race, political opinions, trade union membership, religious beliefs, sex life, or sexual orientation',
+    verifyMessage: 'Does this classify people by protected characteristics (race, religion, sexual orientation)?',
+  },
+  {
+    name: 'arcface',
+    ecosystem: 'pip',
+    reason: 'Face recognition / biometric categorization',
+    obligationId: 'eu-ai-act-OBL-002',
+    article: 'Art. 5(1)(g)',
+    penalty: '€35M or 7% turnover',
+    prohibitedWhen: 'Categorizes persons by biometric data to infer race, political opinions, trade union membership, religious beliefs, sex life, or sexual orientation',
+    verifyMessage: 'Does this classify people by protected characteristics (race, religion, sexual orientation)?',
+  },
+  {
+    name: 'openface',
+    ecosystem: 'any',
+    reason: 'Open-source face recognition',
+    obligationId: 'eu-ai-act-OBL-002',
+    article: 'Art. 5(1)(g)',
+    penalty: '€35M or 7% turnover',
+    prohibitedWhen: 'Categorizes persons by biometric data to infer race, political opinions, trade union membership, religious beliefs, sex life, or sexual orientation',
+    verifyMessage: 'Does this classify people by protected characteristics (race, religion, sexual orientation)?',
+  },
+  {
+    name: 'compreface',
+    ecosystem: 'any',
+    reason: 'Face recognition / biometric ID service',
+    obligationId: 'eu-ai-act-OBL-002',
+    article: 'Art. 5(1)(g)',
+    penalty: '€35M or 7% turnover',
+    prohibitedWhen: 'Categorizes persons by biometric data to infer race, political opinions, trade union membership, religious beliefs, sex life, or sexual orientation',
+    verifyMessage: 'Does this classify people by protected characteristics (race, religion, sexual orientation)?',
+  },
+  {
+    name: 'amazon-rekognition',
+    ecosystem: 'any',
+    reason: 'Cloud biometric identification',
+    obligationId: 'eu-ai-act-OBL-002',
+    article: 'Art. 5(1)(g)',
+    penalty: '€35M or 7% turnover',
+    prohibitedWhen: 'Categorizes persons by biometric data to infer race, political opinions, trade union membership, religious beliefs, sex life, or sexual orientation',
+    verifyMessage: 'Does this classify people by protected characteristics (race, religion, sexual orientation)?',
+  },
+  {
+    name: '@azure/cognitiveservices-face',
+    ecosystem: 'npm',
+    reason: 'Cloud biometric face API',
+    obligationId: 'eu-ai-act-OBL-002',
+    article: 'Art. 5(1)(g)',
+    penalty: '€35M or 7% turnover',
+    prohibitedWhen: 'Categorizes persons by biometric data to infer race, political opinions, trade union membership, religious beliefs, sex life, or sexual orientation',
+    verifyMessage: 'Does this classify people by protected characteristics (race, religion, sexual orientation)?',
+  },
+  {
+    name: 'azure-cognitiveservices-vision-face',
+    ecosystem: 'pip',
+    reason: 'Cloud biometric face API',
+    obligationId: 'eu-ai-act-OBL-002',
+    article: 'Art. 5(1)(g)',
+    penalty: '€35M or 7% turnover',
+    prohibitedWhen: 'Categorizes persons by biometric data to infer race, political opinions, trade union membership, religious beliefs, sex life, or sexual orientation',
+    verifyMessage: 'Does this classify people by protected characteristics (race, religion, sexual orientation)?',
+  },
+  {
+    name: 'google-cloud-vision',
+    ecosystem: 'pip',
+    reason: 'Cloud biometric identification',
+    obligationId: 'eu-ai-act-OBL-002',
+    article: 'Art. 5(1)(g)',
+    penalty: '€35M or 7% turnover',
+    prohibitedWhen: 'Categorizes persons by biometric data to infer race, political opinions, trade union membership, religious beliefs, sex life, or sexual orientation',
+    verifyMessage: 'Does this classify people by protected characteristics (race, religion, sexual orientation)?',
+  },
+  {
+    name: 'clarifai',
+    ecosystem: 'any',
+    reason: 'Visual biometric recognition',
+    obligationId: 'eu-ai-act-OBL-002',
+    article: 'Art. 5(1)(g)',
+    penalty: '€35M or 7% turnover',
+    prohibitedWhen: 'Categorizes persons by biometric data to infer race, political opinions, trade union membership, religious beliefs, sex life, or sexual orientation',
+    verifyMessage: 'Does this classify people by protected characteristics (race, religion, sexual orientation)?',
+  },
+  {
+    name: 'kairos',
+    ecosystem: 'any',
+    reason: 'Face recognition API',
+    obligationId: 'eu-ai-act-OBL-002',
+    article: 'Art. 5(1)(g)',
+    penalty: '€35M or 7% turnover',
+    prohibitedWhen: 'Categorizes persons by biometric data to infer race, political opinions, trade union membership, religious beliefs, sex life, or sexual orientation',
+    verifyMessage: 'Does this classify people by protected characteristics (race, religion, sexual orientation)?',
+  },
+  {
+    name: 'luxand',
+    ecosystem: 'any',
+    reason: 'Face recognition SDK',
+    obligationId: 'eu-ai-act-OBL-002',
+    article: 'Art. 5(1)(g)',
+    penalty: '€35M or 7% turnover',
+    prohibitedWhen: 'Categorizes persons by biometric data to infer race, political opinions, trade union membership, religious beliefs, sex life, or sexual orientation',
+    verifyMessage: 'Does this classify people by protected characteristics (race, religion, sexual orientation)?',
+  },
+  {
+    name: 'facepp',
+    ecosystem: 'any',
+    reason: 'Face++ biometric recognition',
+    obligationId: 'eu-ai-act-OBL-002',
+    article: 'Art. 5(1)(g)',
+    penalty: '€35M or 7% turnover',
+    prohibitedWhen: 'Categorizes persons by biometric data to infer race, political opinions, trade union membership, religious beliefs, sex life, or sexual orientation',
+    verifyMessage: 'Does this classify people by protected characteristics (race, religion, sexual orientation)?',
+  },
+  {
+    name: 'deepid',
+    ecosystem: 'pip',
+    reason: 'Deep face identification',
+    obligationId: 'eu-ai-act-OBL-002',
+    article: 'Art. 5(1)(g)',
+    penalty: '€35M or 7% turnover',
+    prohibitedWhen: 'Categorizes persons by biometric data to infer race, political opinions, trade union membership, religious beliefs, sex life, or sexual orientation',
+    verifyMessage: 'Does this classify people by protected characteristics (race, religion, sexual orientation)?',
+  },
+
+  // --- Art. 5(1)(h): Real-time remote biometric ID in public spaces ---
+  {
+    name: 'real-time-facial',
+    ecosystem: 'any',
+    reason: 'Real-time facial recognition in public spaces',
+    obligationId: 'eu-ai-act-OBL-002',
+    article: 'Art. 5(1)(h)',
+    penalty: '€35M or 7% turnover',
+    prohibitedWhen: 'Real-time remote biometric identification in publicly accessible spaces for law enforcement, except for targeted search for specific victims, prevention of imminent threat, or specific serious crimes',
+    verifyMessage: 'Is this used for real-time biometric identification in public spaces? (Specific law enforcement exceptions may apply)',
+  },
+  {
+    name: 'crowd-face',
+    ecosystem: 'any',
+    reason: 'Crowd facial recognition',
+    obligationId: 'eu-ai-act-OBL-002',
+    article: 'Art. 5(1)(h)',
+    penalty: '€35M or 7% turnover',
+    prohibitedWhen: 'Real-time remote biometric identification in publicly accessible spaces for law enforcement, except for targeted search for specific victims, prevention of imminent threat, or specific serious crimes',
+    verifyMessage: 'Is this used for real-time biometric identification in public spaces? (Specific law enforcement exceptions may apply)',
+  },
+  {
+    name: 'surveillance-ai',
+    ecosystem: 'any',
+    reason: 'AI surveillance system',
+    obligationId: 'eu-ai-act-OBL-002',
+    article: 'Art. 5(1)(h)',
+    penalty: '€35M or 7% turnover',
+    prohibitedWhen: 'Real-time remote biometric identification in publicly accessible spaces for law enforcement, except for targeted search for specific victims, prevention of imminent threat, or specific serious crimes',
+    verifyMessage: 'Is this used for real-time biometric identification in public spaces? (Specific law enforcement exceptions may apply)',
+  },
+  {
+    name: 'mass-surveillance',
+    ecosystem: 'any',
+    reason: 'Mass surveillance toolkit',
+    obligationId: 'eu-ai-act-OBL-002',
+    article: 'Art. 5(1)(h)',
+    penalty: '€35M or 7% turnover',
+    prohibitedWhen: 'Real-time remote biometric identification in publicly accessible spaces for law enforcement, except for targeted search for specific victims, prevention of imminent threat, or specific serious crimes',
+    verifyMessage: 'Is this used for real-time biometric identification in public spaces? (Specific law enforcement exceptions may apply)',
+  },
+  {
+    name: 'live-biometric',
+    ecosystem: 'any',
+    reason: 'Live biometric identification',
+    obligationId: 'eu-ai-act-OBL-002',
+    article: 'Art. 5(1)(h)',
+    penalty: '€35M or 7% turnover',
+    prohibitedWhen: 'Real-time remote biometric identification in publicly accessible spaces for law enforcement, except for targeted search for specific victims, prevention of imminent threat, or specific serious crimes',
+    verifyMessage: 'Is this used for real-time biometric identification in public spaces? (Specific law enforcement exceptions may apply)',
+  },
+];
+
+export interface ProhibitedPattern {
+  readonly regex: RegExp;
+  readonly reason: string;
+  readonly article: string;
+}
+
+export const PROHIBITED_PATTERNS: readonly ProhibitedPattern[] = [
+  // Art. 5(1)(a) — Subliminal/manipulative/deceptive techniques
+  { regex: /subliminal.*messag/i, reason: 'Subliminal messaging', article: 'Art. 5(1)(a)' },
+  { regex: /manipulat(e|ive|ion).*behavio(r|ur)/i, reason: 'Behavioral manipulation', article: 'Art. 5(1)(a)' },
+  { regex: /dark.?pattern.*ai/i, reason: 'AI-powered dark patterns', article: 'Art. 5(1)(a)' },
+  { regex: /deceptive.*ai.*technique/i, reason: 'Deceptive AI technique', article: 'Art. 5(1)(a)' },
+  { regex: /covert.*persuasion/i, reason: 'Covert persuasion technique', article: 'Art. 5(1)(a)' },
+
+  // Art. 5(1)(b) — Exploitation of vulnerabilities (age, disability, social/economic situation)
+  { regex: /exploit.*(vulnerab|elderly|disabled|minors?|children)/i, reason: 'Exploitation of vulnerable groups', article: 'Art. 5(1)(b)' },
+  { regex: /target.*(elderly|senior|disabled|impair|minor|child)/i, reason: 'Targeting vulnerable persons', article: 'Art. 5(1)(b)' },
+  { regex: /age.?based.*(manipulat|exploit|target)/i, reason: 'Age-based exploitation', article: 'Art. 5(1)(b)' },
+  { regex: /disability.*(exploit|manipulat|target)/i, reason: 'Disability-based exploitation', article: 'Art. 5(1)(b)' },
+  { regex: /economic.?vulnerab.*(exploit|target)/i, reason: 'Economic vulnerability exploitation', article: 'Art. 5(1)(b)' },
+
+  // Art. 5(1)(c) — Social scoring
+  { regex: /social.*scor(e|ing)/i, reason: 'Social scoring system', article: 'Art. 5(1)(c)' },
+  { regex: /citizen.*rating/i, reason: 'Citizen rating system', article: 'Art. 5(1)(c)' },
+  { regex: /behavio(r|ur).*rating.*system/i, reason: 'Behavioral rating system', article: 'Art. 5(1)(c)' },
+
+  // Art. 5(1)(d) — Criminal risk prediction based on profiling
+  { regex: /predictive.*polic/i, reason: 'Predictive policing', article: 'Art. 5(1)(d)' },
+  { regex: /crime.*predict/i, reason: 'Criminal risk prediction', article: 'Art. 5(1)(d)' },
+  { regex: /recidivism.*predict/i, reason: 'Recidivism prediction', article: 'Art. 5(1)(d)' },
+  { regex: /criminal.*profil/i, reason: 'Criminal profiling', article: 'Art. 5(1)(d)' },
+
+  // Art. 5(1)(e) — Untargeted facial scraping
+  { regex: /facial.*scrap(e|ing)/i, reason: 'Facial image scraping', article: 'Art. 5(1)(e)' },
+  { regex: /face.*harvest/i, reason: 'Face data harvesting', article: 'Art. 5(1)(e)' },
+  { regex: /scrape.*face.*image/i, reason: 'Scraping facial images', article: 'Art. 5(1)(e)' },
+
+  // Art. 5(1)(f) — Emotion recognition in workplace/education
+  { regex: /emotion.*recogni(tion|ze|zer).*real.?time/i, reason: 'Real-time emotion recognition', article: 'Art. 5(1)(f)' },
+  { regex: /emotion.*detect.*work(place|er|force)/i, reason: 'Workplace emotion detection', article: 'Art. 5(1)(f)' },
+  { regex: /emotion.*detect.*school|classroom.*emotion/i, reason: 'Education emotion detection', article: 'Art. 5(1)(f)' },
+  { regex: /affect(ive)?.?comput.*employ/i, reason: 'Affective computing for employees', article: 'Art. 5(1)(f)' },
+
+  // Art. 5(1)(g) — Biometric categorization by sensitive characteristics
+  { regex: /biometric.*categori[sz]/i, reason: 'Biometric categorization', article: 'Art. 5(1)(g)' },
+  { regex: /infer.*(race|religion|politic|sexual.?orient)/i, reason: 'Inferring sensitive attributes', article: 'Art. 5(1)(g)' },
+  { regex: /biometric.*(race|ethnic|gender)/i, reason: 'Biometric sensitive classification', article: 'Art. 5(1)(g)' },
+
+  // Art. 5(1)(h) — Real-time remote biometric identification in public spaces
+  { regex: /mass.*surveillance/i, reason: 'Mass surveillance', article: 'Art. 5(1)(h)' },
+  { regex: /real.?time.*biometric.*identif/i, reason: 'Real-time biometric identification', article: 'Art. 5(1)(h)' },
+  { regex: /live.*face.*recogni(tion|ze)/i, reason: 'Live facial recognition', article: 'Art. 5(1)(h)' },
+  { regex: /public.*space.*biometric/i, reason: 'Public space biometric ID', article: 'Art. 5(1)(h)' },
+];

package/src/domain/scanner/rules/banned-packages-sdk.ts

@@ -0,0 +1,65 @@
+export const AI_SDK_PACKAGES: ReadonlyMap<string, string> = new Map([
+  // npm
+  ['openai', 'OpenAI'],
+  ['@anthropic-ai/sdk', 'Anthropic'],
+  ['anthropic', 'Anthropic'],
+  ['@google/generative-ai', 'Google AI'],
+  ['@google-cloud/aiplatform', 'Google Vertex AI'],
+  ['cohere-ai', 'Cohere'],
+  ['@mistralai/mistralai', 'Mistral'],
+  ['ai', 'Vercel AI SDK'],
+  ['@ai-sdk/openai', 'Vercel AI SDK (OpenAI)'],
+  ['@ai-sdk/anthropic', 'Vercel AI SDK (Anthropic)'],
+  ['@ai-sdk/google', 'Vercel AI SDK (Google)'],
+  ['@ai-sdk/mistral', 'Vercel AI SDK (Mistral)'],
+  ['@ai-sdk/amazon-bedrock', 'Vercel AI SDK (Bedrock)'],
+  ['langchain', 'LangChain'],
+  ['@langchain/core', 'LangChain Core'],
+  ['@langchain/openai', 'LangChain (OpenAI)'],
+  ['@langchain/anthropic', 'LangChain (Anthropic)'],
+  ['@langchain/community', 'LangChain (Community)'],
+  ['llamaindex', 'LlamaIndex'],
+  ['replicate', 'Replicate'],
+  ['huggingface', 'Hugging Face'],
+  ['@huggingface/inference', 'Hugging Face Inference'],
+  ['@openclaw/sdk', 'OpenClaw'],
+  ['groq-sdk', 'Groq'],
+  ['ollama', 'Ollama'],
+  ['@aws-sdk/client-bedrock-runtime', 'Amazon Bedrock'],
+  ['@azure/openai', 'Azure OpenAI'],
+  // pip
+  ['google-generativeai', 'Google AI'],
+  ['cohere', 'Cohere'],
+  ['mistralai', 'Mistral'],
+  ['llama-index', 'LlamaIndex'],
+  ['transformers', 'Hugging Face Transformers'],
+  ['torch', 'PyTorch'],
+  ['tensorflow', 'TensorFlow'],
+  ['crewai', 'CrewAI'],
+  ['pyautogen', 'AutoGen'],
+  ['groq', 'Groq'],
+  ['together', 'Together AI'],
+  ['fireworks-ai', 'Fireworks AI'],
+  ['litellm', 'LiteLLM'],
+  ['semantic-kernel', 'Semantic Kernel'],
+  ['haystack-ai', 'Haystack'],
+  ['instructor', 'Instructor'],
+  ['dspy-ai', 'DSPy'],
+  ['phidata', 'Phidata'],
+  ['boto3', 'AWS SDK (Bedrock)'],
+  ['deepseek-sdk', 'DeepSeek'],
+  // cargo
+  ['async-openai', 'OpenAI (Rust)'],
+  ['llm', 'LLM (Rust)'],
+  // go
+  ['github.com/sashabaranov/go-openai', 'OpenAI (Go)'],
+  ['github.com/anthropics/anthropic-sdk-go', 'Anthropic (Go)'],
+]);
+
+export const BIAS_TESTING_PACKAGES: ReadonlySet<string> = new Set([
+  'fairlearn',
+  'aif360',
+  'aequitas',
+  'responsibleai',
+  '@responsible-ai/fairness',
+]);