@connexum/ai-governance 1.0.0-beta.11

package/dist/packs/eu-dsa.js

@@ -0,0 +1,179 @@
+"use strict";
+/**
+ * EU Digital Services Act (DSA) Compliance Pack
+ *
+ * Regulation: Regulation (EU) 2022/2065 of the European Parliament and
+ *   of the Council of 19 October 2022 on a Single Market For Digital
+ *   Services. Fully applicable from 17 February 2024 for all in-scope
+ *   intermediary services; VLOP / VLOSE designations applied earlier.
+ *
+ * Jurisdiction: EU-wide
+ * Authority:
+ *   - European Commission — VLOP / VLOSE supervision (very large
+ *     online platforms / search engines >45M EU monthly users)
+ *   - National Digital Services Coordinators (DSCs) — supervision of
+ *     non-VLOP services + cooperation with Commission
+ *
+ * Why this pack (separate from UK Online Safety Act):
+ *   - UK Online Safety Act 2023 (`uk-online-safety-act` pack) and EU
+ *     DSA are PARALLEL regimes — distinct statutes, different
+ *     regulators, different penalty scales, different VLOP thresholds,
+ *     different transparency-report cadences.
+ *   - Multi-region online services need BOTH packs registered.
+ *   - DSA introduces unique obligations: trusted flaggers, statement
+ *     of reasons (SoR), DSA transparency database, researcher access
+ *     (Art. 40), risk assessments + mitigation (Art. 34/35).
+ *
+ * Service tiers (the DSA uses a layered cake of obligations):
+ *   - **All intermediary services** (Arts. 11–18) — basic obligations
+ *   - **Hosting services** (Arts. 16–18) — notice + action mechanism
+ *   - **Online platforms** (Arts. 19–28) — internal complaint, trusted
+ *     flaggers, ban on dark patterns, ad transparency, minor protection
+ *   - **VLOPs / VLOSEs** (Arts. 33–43) — risk assessments + mitigations
+ *     + auditing + crisis response + researcher access + recommender
+ *     transparency
+ *
+ * Penalties:
+ *   - Up to 6% of worldwide annual turnover
+ *   - Periodic penalty payments up to 5% of worldwide daily turnover
+ *   - VLOP / VLOSE supervisory fees
+ *
+ * Out of scope:
+ *   - UK Online Safety Act 2023 (separate pack)
+ *   - EU DMA (separate pack — different regime: gatekeeper conduct vs
+ *     platform content)
+ *   - GDPR personal-data overlays (separate pack)
+ *
+ * @connexum/ai-governance
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EU_DSA_PACK = exports.EU_DSA_CATEGORY_CLASSIFIERS = void 0;
+exports.EU_DSA_CATEGORY_CLASSIFIERS = {
+    ILLEGAL_CONTENT_NOTICE: {
+        references: ['DSA Art. 16 — notice and action mechanism'],
+        classifier: (input) => {
+            if (/\b(?:dsa\s+(?:notice|notice\s+and\s+action|art\.?\s*16)|article\s+16\s+dsa|illegal\s+content\s+notice\s+dsa)\b/i.test(input))
+                return true;
+            if (/\b(?:trusted\s+flagger|art\.?\s*22\s+dsa|notice\s+priority\s+treatment)\b/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    STATEMENT_OF_REASONS: {
+        references: ['DSA Art. 17 — statement of reasons'],
+        classifier: (input) => {
+            if (/\b(?:statement\s+of\s+reasons|sor\s+dsa|art\.?\s*17\s+dsa|dsa\s+transparency\s+database)\b/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    RISK_ASSESSMENT_DSA: {
+        references: ['DSA Arts. 34, 35 — VLOP/VLOSE systemic risk assessment + mitigation'],
+        classifier: (input) => {
+            if (/\b(?:dsa\s+risk\s+assessment|art\.?\s*34\s+dsa|art\.?\s*35\s+dsa|systemic\s+risk\s+(?:assessment|mitigation)\s+dsa)\b/i.test(input))
+                return true;
+            if (/\b(?:vlop\s+risk\s+assessment|vlose\s+risk\s+assessment|crisis\s+response\s+dsa)\b/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    RECOMMENDER_TRANSPARENCY: {
+        references: ['DSA Arts. 27, 38 — recommender system transparency'],
+        classifier: (input) => {
+            if (/\b(?:recommender\s+(?:transparency|system|parameter)\s+dsa|art\.?\s*27\s+dsa|art\.?\s*38\s+dsa)\b/i.test(input))
+                return true;
+            if (/\b(?:non[\s-]?profiling\s+option|recommender\s+opt[\s-]?out)\b/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    AD_TRANSPARENCY: {
+        references: ['DSA Arts. 26, 39 — advertising transparency + repository'],
+        classifier: (input) => {
+            if (/\b(?:dsa\s+ad\s+(?:transparency|repository)|art\.?\s*26\s+dsa|art\.?\s*39\s+dsa|ad\s+repository\s+dsa)\b/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    RESEARCHER_ACCESS: {
+        references: ['DSA Art. 40 — researcher data access'],
+        classifier: (input) => {
+            if (/\b(?:dsa\s+researcher\s+access|art\.?\s*40\s+dsa|vetted\s+researcher\s+dsa)\b/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    CREDENTIALS: {
+        references: ['Cross-pack secrets safety'],
+        classifier: (input) => {
+            if (/\b(?:api[_-]?key|apikey)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(input))
+                return true;
+            if (/\bpassword\s*[=:]\s*["']?[A-Za-z0-9!@#$%^&*_\-]{8,}["']?/i.test(input))
+                return true;
+            if (/-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/.test(input))
+                return true;
+            return false;
+        },
+    },
+};
+exports.EU_DSA_PACK = {
+    categoryClassifiers: exports.EU_DSA_CATEGORY_CLASSIFIERS,
+    id: 'eu-dsa',
+    aliases: ['dsa', 'digital-services-act', 'regulation-2022-2065', 'eu-digital-services-act'],
+    name: 'EU Digital Services Act (Regulation (EU) 2022/2065)',
+    version: '1.0.0',
+    description: 'EU Digital Services Act — fully applicable 17 Feb 2024. Layered-cake regime: all intermediary services (Arts. 11-18) → hosting services (Arts. 16-18 notice and action) → online platforms (Arts. 19-28: internal complaint, trusted flaggers, dark-pattern ban, ad transparency, minor protection) → VLOPs / VLOSEs (Arts. 33-43: systemic risk assessment + mitigation, auditing, crisis response, researcher access, recommender transparency). EU peer of UK Online Safety Act 2023 (`uk-online-safety-act` pack); multi-region services need BOTH. Penalties up to 6% global turnover; periodic penalty payments up to 5% global daily turnover.',
+    authority: 'European Commission (VLOP/VLOSE supervision) + National Digital Services Coordinators',
+    industries: ['technology', 'media', 'social-media', 'gaming', 'search', 'cloud-infrastructure', 'adult-content'],
+    requiredModules: [
+        { name: 'governance-runtime', required: true, reason: 'Notice-and-action gate; trusted-flagger priority treatment; dark-pattern ban (Art. 25); minor-protection gate.', reference: 'DSA Arts. 16, 22, 25, 28' },
+        { name: 'data-classifier', required: true, reason: 'Detect illegal-content notices, SoR records, risk assessments, recommender transparency artefacts, ad-repository submissions, researcher-access requests.', reference: 'DSA evidence categorisation' },
+        { name: 'attestation-manager', required: true, reason: 'Service-tier designation (intermediary / hosting / platform / VLOP / VLOSE); trusted-flagger registration; risk-assessment cycle (annual for VLOPs); independent-audit attestation (Art. 37).', reference: 'DSA Arts. 33, 37' },
+        { name: 'event-bus', required: true, reason: 'SoR routing to DSA transparency database; trusted-flagger priority queue; researcher-access ticket routing; crisis-response trigger (Art. 36).', reference: 'DSA Arts. 17, 22, 36, 40' },
+        { name: 'audit-integrity', required: true, reason: 'Tamper-evident audit chain for moderation decisions, SoRs, risk-assessment revisions, audit-report responses — required for Commission / DSC investigation.', reference: 'DSA evidentiary integrity' },
+        { name: 'transparency-injector', required: true, reason: 'Terms of service publication (Art. 14); ad-repository visibility; recommender-transparency disclosure + non-profiling option; trusted-flagger surface.', reference: 'DSA Arts. 14, 26, 27, 39' },
+        { name: 'approval-queue', required: true, reason: 'Material policy changes routed for senior + legal review (T2); risk-mitigation measure approval; audit-report sign-off.', reference: 'DSA Arts. 35, 37' },
+        { name: 'session-persistence', required: true, reason: 'Moderation + SoR records retained at least the limitation period; audit-report archive across the audit cycle.', reference: 'DSA Art. 37 audit cycle; Limitation rules' },
+        { name: 'agent-auth', required: true, reason: 'Trusted-flagger identity binding; vetted-researcher identity binding for Art. 40 access.', reference: 'DSA Arts. 22, 40' },
+        { name: 'supply-chain', required: true, reason: 'Sub-supplier moderation / hosting / age-assurance attestation; processor flow-down for in-scope services.', reference: 'DSA service-chain accountability' },
+    ],
+    moduleConfig: {
+        'governance-runtime': { dsaNoticeAndActionGateRequired: true, darkPatternBanGateRequired: true, minorProtectionGateRequired: true },
+        'data-classifier': { enabledCategories: ['ILLEGAL_CONTENT_NOTICE', 'STATEMENT_OF_REASONS', 'RISK_ASSESSMENT_DSA', 'RECOMMENDER_TRANSPARENCY', 'AD_TRANSPARENCY', 'RESEARCHER_ACCESS', 'CREDENTIALS'], credentialsAction: 'BLOCK' },
+        'attestation-manager': { serviceTierDesignationTracked: true, trustedFlaggerRegistrationTracked: true, vlopRiskAssessmentAnnualRequired: true, independentAuditAttestationRequired: true },
+        'event-bus': { sorRoutingToDsaTransparencyDbRequired: true, trustedFlaggerPriorityQueueRequired: true, researcherAccessTicketRoutingRequired: true, crisisResponseTriggerRequired: true },
+        'audit-integrity': { dsaInvestigationEvidenceTrackingRequired: true },
+        'transparency-injector': { termsOfServicePublicationRequired: true, adRepositoryVisibilityRequired: true, recommenderTransparencyRequired: true, nonProfilingOptionRequired: true },
+        'approval-queue': { reviewTier: 'T2' },
+        'session-persistence': { retentionDaysMinimum: 2190 },
+        'agent-auth': { trustedFlaggerIdentityBindingRequired: true, researcherIdentityBindingRequired: true },
+        'supply-chain': { processorFlowDownRequired: true },
+    },
+    providerPolicy: {
+        blockedProviders: ['deepseek', 'baidu', 'alibaba'],
+        requiredCapabilities: ['DATA-RESIDENCY-EU', 'PROCESSOR-CONTRACT', 'DSA-EVIDENCE-EXPORT'],
+        blockReasons: { deepseek: 'PRC jurisdiction. DSA evidence chain (moderation decisions, SoRs, risk assessments) cannot route through PRC.', baidu: 'PRC jurisdiction.', alibaba: 'PRC jurisdiction.' },
+    },
+    dataPolicy: {
+        scanCategories: ['ILLEGAL_CONTENT_NOTICE', 'STATEMENT_OF_REASONS', 'RISK_ASSESSMENT_DSA', 'RECOMMENDER_TRANSPARENCY', 'AD_TRANSPARENCY', 'RESEARCHER_ACCESS', 'CREDENTIALS'],
+        categoryActions: { ILLEGAL_CONTENT_NOTICE: 'WARN', STATEMENT_OF_REASONS: 'WARN', RISK_ASSESSMENT_DSA: 'WARN', RECOMMENDER_TRANSPARENCY: 'WARN', AD_TRANSPARENCY: 'WARN', RESEARCHER_ACCESS: 'WARN', CREDENTIALS: 'BLOCK' },
+        encryptionRequired: true,
+        encryptionStandard: 'AES-256-GCM',
+        minimumClassification: 'RESTRICTED',
+    },
+    retentionPolicy: { auditLogRetentionDays: 2190, sessionRetentionDays: 2190, incidentRetentionDays: 2190, reference: 'DSA Art. 37 audit cycle; civil-claim limitation periods', forceDelete: false, requiresLegalHoldSupport: true, sovereignty: ['eu'] },
+    incidentPolicy: { notificationDeadlineHours: 72, reference: 'DSA Art. 11 single point of contact; Commission information notice timing', requiredRecipients: ['european-commission', 'national-digital-services-coordinator', 'data-protection-officer'], formalNotificationRequired: true },
+    validators: [
+        { id: 'eu-dsa-service-tier-designated', description: 'Service tier designated (intermediary / hosting / platform / VLOP / VLOSE) with rationale.', reference: 'DSA Arts. 11-43', check: 'attestation_active', failSeverity: 'CRITICAL' },
+        { id: 'eu-dsa-notice-and-action', description: 'Notice and action mechanism active for hosting services; trusted-flagger priority queue.', reference: 'DSA Arts. 16, 22', check: 'governance_active', failSeverity: 'CRITICAL' },
+        { id: 'eu-dsa-statement-of-reasons', description: 'Statement of Reasons issued + submitted to DSA transparency database for every moderation action.', reference: 'DSA Art. 17', check: 'monitoring_active', failSeverity: 'CRITICAL' },
+        { id: 'eu-dsa-vlop-risk-assessment', description: 'Annual systemic risk assessment + mitigation plan filed for VLOPs/VLOSEs.', reference: 'DSA Arts. 34, 35', check: 'attestation_active', failSeverity: 'CRITICAL' },
+        { id: 'eu-dsa-recommender-transparency', description: 'Recommender system parameters disclosed; non-profiling option offered.', reference: 'DSA Arts. 27, 38', check: 'transparency_active', failSeverity: 'HIGH' },
+        { id: 'eu-dsa-ad-transparency', description: 'Ad repository visible; ad-targeting parameters disclosed.', reference: 'DSA Arts. 26, 39', check: 'transparency_active', failSeverity: 'HIGH' },
+        { id: 'eu-dsa-researcher-access', description: 'Vetted-researcher access pathway available per Art. 40 for VLOPs/VLOSEs.', reference: 'DSA Art. 40', check: 'attestation_active', failSeverity: 'HIGH' },
+        { id: 'eu-dsa-independent-audit', description: 'Independent audit (Art. 37) completed annually for VLOPs/VLOSEs; audit-report archived.', reference: 'DSA Art. 37', check: 'attestation_active', failSeverity: 'HIGH' },
+        { id: 'eu-dsa-evidence-audit-trail', description: 'Tamper-evident audit chain covers moderation decisions, SoRs, risk assessments, audit reports.', reference: 'DSA evidentiary integrity', check: 'audit_trail_exists', failSeverity: 'HIGH' },
+        { id: 'eu-dsa-credential-block', description: 'Plaintext credentials blocked from DSA evidence artefacts.', reference: 'DSA evidence integrity', check: 'data_classifier_active', failSeverity: 'CRITICAL' },
+    ],
+};
+//# sourceMappingURL=eu-dsa.js.map

package/dist/packs/eu-dsa.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"eu-dsa.js","sourceRoot":"","sources":["../../src/packs/eu-dsa.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;;;AAKU,QAAA,2BAA2B,GAAwB;IAC9D,sBAAsB,EAAE;QACtB,UAAU,EAAE,CAAC,2CAA2C,CAAC;QACzD,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,iHAAiH,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC/I,IAAI,4EAA4E,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC1G,OAAO,KAAK,CAAC;QACf,CAAC;KACF;IACD,oBAAoB,EAAE;QACpB,UAAU,EAAE,CAAC,oCAAoC,CAAC;QAClD,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,6FAA6F,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC3H,OAAO,KAAK,CAAC;QACf,CAAC;KACF;IACD,mBAAmB,EAAE;QACnB,UAAU,EAAE,CAAC,qEAAqE,CAAC;QACnF,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,wHAAwH,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACtJ,IAAI,qFAAqF,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACnH,OAAO,KAAK,CAAC;QACf,CAAC;KACF;IACD,wBAAwB,EAAE;QACxB,UAAU,EAAE,CAAC,oDAAoD,CAAC;QAClE,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,oGAAoG,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAClI,IAAI,iEAAiE,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC/F,OAAO,KAAK,CAAC;QACf,CAAC;KACF;IACD,eAAe,EAAE;QACf,UAAU,EAAE,CAAC,0DAA0D,CAAC;QACxE,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,2GAA2G,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACzI,OAAO,KAAK,CAAC;QACf,CAAC;KACF;IACD,iBAAiB,EAAE;QACjB,UAAU,EAAE,CAAC,sCAAsC,CAAC;QACpD,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,gFAAgF,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC9G,OAAO,KAAK,CAAC;QACf,CAAC;KACF;IACD,WAAW,EAAE;QACX,UAAU,EAAE,CAAC,2BAA2B,CAAC;QACzC,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,qEAAqE,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACnG,IAAI,2DAA2D,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACzF,IAAI,4CAA4C,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC1E,OAAO,KAAK,CAAC;QACf,CAAC;KACF;CACF,CAAC;AAEW,QAAA,WAAW,GAAkE;IACxF,mBAAmB,EAAE,mCAA2B;IAChD,EAAE,EAAE,QAAQ;IACZ,OAAO,EAAE,CAAC,KAAK,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,yBAAyB,CAAC;IAC3F,IAAI,EAAE,qDAAqD;IAC3D,OAAO,EAAE,OAAO;IAChB,WAAW,EACT,unBAAunB;IACznB,SAAS,EAAE,uFAAuF;IAClG,UAAU,EAAE,CAAC,YAAY,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,QAAQ,EAAE,sBAAsB,EAAE,eAAe,CAAC;IAChH,eAAe,EAAE;QACf,EAAE,IAAI,EAAE,oBAAoB,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,gHAAgH,EAAE,SAAS,EAAE,0BAA0B,EAAE;QAC/M,EAAE,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,2JAA2J,EAAE,SAAS,EAAE,6BAA6B,EAAE;QAC1P,EAAE,IAAI,EAAE,qBAAqB,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,+LAA+L,EAAE,SAAS,EAAE,kBAAkB,EAAE;QACvR,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,gJAAgJ,EAAE,SAAS,EAAE,0BAA0B,EAAE;QACtO,EAAE,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,6JAA6J,EAAE,SAAS,EAAE,2BAA2B,EAAE;QAC1P,EAAE,IAAI,EAAE,uBAAuB,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,wJAAwJ,EAAE,SAAS,EAAE,0BAA0B,EAAE;QAC1P,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,yHAAyH,EAAE,SAAS,EAAE,kBAAkB,EAAE;QAC5M,EAAE,IAAI,EAAE,qBAAqB,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,gHAAgH,EAAE,SAAS,EAAE,2CAA2C,EAAE;QACjO,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,0FAA0F,EAAE,SAAS,EAAE,kBAAkB,EAAE;QACzK,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,2GAA2G,EAAE,SAAS,EAAE,kCAAkC,EAAE;KAC7M;IACD,YAAY,EAAE;QACZ,oBAAoB,EAAE,EAAE,8BAA8B,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,2BAA2B,EAAE,IAAI,EAAE;QACnI,iBAAiB,EAAE,EAAE,iBAAiB,EAAE,CAAC,wBAAwB,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,0BAA0B,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,aAAa,CAAC,EAAE,iBAAiB,EAAE,OAAO,EAAE;QAClO,qBAAqB,EAAE,EAAE,6BAA6B,EAAE,IAAI,EAAE,iCAAiC,EAAE,IAAI,EAAE,gCAAgC,EAAE,IAAI,EAAE,mCAAmC,EAAE,IAAI,EAAE;QAC1L,WAAW,EAAE,EAAE,qCAAqC,EAAE,IAAI,EAAE,mCAAmC,EAAE,IAAI,EAAE,qCAAqC,EAAE,IAAI,EAAE,6BAA6B,EAAE,IAAI,EAAE;QACzL,iBAAiB,EAAE,EAAE,wCAAwC,EAAE,IAAI,EAAE;QACrE,uBAAuB,EAAE,EAAE,iCAAiC,EAAE,IAAI,EAAE,8BAA8B,EAAE,IAAI,EAAE,+BAA+B,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE;QACnL,gBAAgB,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE;QACtC,qBAAqB,EAAE,EAAE,oBAAoB,EAAE,IAAI,EAAE;QACrD,YAAY,EAAE,EAAE,qCAAqC,EAAE,IAAI,EAAE,iCAAiC,EAAE,IAAI,EAAE;QACtG,cAAc,EAAE,EAAE,yBAAyB,EAAE,IAAI,EAAE;KACpD;IACD,cAAc,EAAE;QACd,gBAAgB,EAAE,CAAC,UAAU,EAAE,OAAO,EAAE,SAAS,CAAC;QAClD,oBAAoB,EAAE,CAAC,mBAAmB,EAAE,oBAAoB,EAAE,qBAAqB,CAAC;QACxF,YAAY,EAAE,EAAE,QAAQ,EAAE,+GAA+G,EAAE,KAAK,EAAE,mBAAmB,EAAE,OAAO,EAAE,mBAAmB,EAAE;KACtM;IACD,UAAU,EAAE;QACV,cAAc,EAAE,CAAC,wBAAwB,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,0BAA0B,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,aAAa,CAAC;QAC5K,eAAe,EAAE,EAAE,sBAAsB,EAAE,MAAM,EAAE,oBAAoB,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM,EAAE,wBAAwB,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE;QAC1N,kBAAkB,EAAE,IAAI;QACxB,kBAAkB,EAAE,aAAa;QACjC,qBAAqB,EAAE,YAAY;KACpC;IACD,eAAe,EAAE,EAAE,qBAAqB,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,SAAS,EAAE,yDAAyD,EAAE,WAAW,EAAE,KAAK,EAAE,wBAAwB,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,IAAI,CAAC,EAAE;IACxP,cAAc,EAAE,EAAE,yBAAyB,EAAE,EAAE,EAAE,SAAS,EAAE,2EAA2E,EAAE,kBAAkB,EAAE,CAAC,qBAAqB,EAAE,uCAAuC,EAAE,yBAAyB,CAAC,EAAE,0BAA0B,EAAE,IAAI,EAAE;IAC5R,UAAU,EAAE;QACV,EAAE,EAAE,EAAE,gCAAgC,EAAE,WAAW,EAAE,4FAA4F,EAAE,SAAS,EAAE,iBAAiB,EAAE,KAAK,EAAE,oBAAoB,EAAE,YAAY,EAAE,UAAU,EAAE;QACxO,EAAE,EAAE,EAAE,0BAA0B,EAAE,WAAW,EAAE,0FAA0F,EAAE,SAAS,EAAE,kBAAkB,EAAE,KAAK,EAAE,mBAAmB,EAAE,YAAY,EAAE,UAAU,EAAE;QAChO,EAAE,EAAE,EAAE,6BAA6B,EAAE,WAAW,EAAE,mGAAmG,EAAE,SAAS,EAAE,aAAa,EAAE,KAAK,EAAE,mBAAmB,EAAE,YAAY,EAAE,UAAU,EAAE;QACvO,EAAE,EAAE,EAAE,6BAA6B,EAAE,WAAW,EAAE,2EAA2E,EAAE,SAAS,EAAE,kBAAkB,EAAE,KAAK,EAAE,oBAAoB,EAAE,YAAY,EAAE,UAAU,EAAE;QACrN,EAAE,EAAE,EAAE,iCAAiC,EAAE,WAAW,EAAE,wEAAwE,EAAE,SAAS,EAAE,kBAAkB,EAAE,KAAK,EAAE,qBAAqB,EAAE,YAAY,EAAE,MAAM,EAAE;QACnN,EAAE,EAAE,EAAE,wBAAwB,EAAE,WAAW,EAAE,2DAA2D,EAAE,SAAS,EAAE,kBAAkB,EAAE,KAAK,EAAE,qBAAqB,EAAE,YAAY,EAAE,MAAM,EAAE;QAC7L,EAAE,EAAE,EAAE,0BAA0B,EAAE,WAAW,EAAE,0EAA0E,EAAE,SAAS,EAAE,aAAa,EAAE,KAAK,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,EAAE;QACxM,EAAE,EAAE,EAAE,0BAA0B,EAAE,WAAW,EAAE,yFAAyF,EAAE,SAAS,EAAE,aAAa,EAAE,KAAK,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,EAAE;QACvN,EAAE,EAAE,EAAE,6BAA6B,EAAE,WAAW,EAAE,gGAAgG,EAAE,SAAS,EAAE,2BAA2B,EAAE,KAAK,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,EAAE;QAC/O,EAAE,EAAE,EAAE,yBAAyB,EAAE,WAAW,EAAE,4DAA4D,EAAE,SAAS,EAAE,wBAAwB,EAAE,KAAK,EAAE,wBAAwB,EAAE,YAAY,EAAE,UAAU,EAAE;KAC7M;CACF,CAAC"}

package/dist/packs/eu-lpp.d.ts

@@ -0,0 +1,61 @@
+/**
+ * EU Legal Professional Privilege Compliance Pack
+ *
+ * Governs the protection of lawyer-client communications under EU law
+ * as established by ECJ jurisprudence and reflected in member-state law.
+ *
+ * Primary authority:
+ *   - ECJ Case C-550/07 P, Akzo Nobel Chemicals v Commission (2010):
+ *     the definitive EU LPP standard. LPP applies ONLY to communications
+ *     with external lawyers who are members of an EU/EEA Bar and are
+ *     independent (not employed by the client). In-house counsel
+ *     communications are NOT privileged under EU law.
+ *   - ECJ Case C-283/05, ASML Netherlands (2006): limits scope of
+ *     LPP in cross-border proceedings.
+ *   - ECJ Case 155/79, AM&S Europe v Commission (1982): original
+ *     establishment of EU LPP doctrine; two conditions -- (1) made for
+ *     the purpose of the client's right of defence; (2) from independent
+ *     lawyers enrolled in an EU/EEA Bar.
+ *   - Member-state law varies in scope: France (secret professionnel),
+ *     Germany (Berufsgeheimnis), Netherlands (verschoningsrecht), etc.
+ *     The EU standard provides a floor; member-state law may be broader.
+ *
+ * Critical distinctions from US ABA privilege:
+ *   - In-house EU counsel are NOT privileged under Akzo Nobel -- only
+ *     external lawyers with EU/EEA Bar membership.
+ *   - Only communications made "for the purpose of the client's right
+ *     of defence" in the context of EU competition / regulatory
+ *     proceedings meet the Akzo Nobel test at EU level.
+ *   - Third-country counsel (US, UK post-Brexit, etc.) -- privilege
+ *     analysis depends on the proceedings and forum; UK solicitors
+ *     are now third-country post-Brexit for EU purposes.
+ *   - UK post-Brexit note: UK solicitors/barristers are no longer
+ *     EU/EEA Bar members. Communications with UK counsel for EU
+ *     Commission proceedings do NOT attract EU LPP. UK GDPR
+ *     domestically preserves UK LPP, but EU Commission cannot be
+ *     required to recognise it.
+ *
+ * Applicable context:
+ *   - EU Commission competition / state aid investigations
+ *   - EU Merger Regulation (EC 139/2004) Phase I/II proceedings
+ *   - EU antitrust (Art. 101/102 TFEU) investigations
+ *   - Any EU regulatory proceeding with access to legal files
+ *   - AI systems processing legal documents at EU-regulated firms
+ *
+ * @connexum/ai-governance
+ */
+import { CompliancePack } from './index';
+import { CategoryClassifiers } from '../classification/pack-driven-classifier';
+/**
+ * EU Legal Professional Privilege category classifiers.
+ * Critically: in-house counsel communications are NOT privileged.
+ * The classifier flags communications that appear privileged but
+ * must separately evaluate whether the lawyer is external and
+ * EU/EEA Bar-enrolled.
+ */
+export declare const EU_LPP_CATEGORY_CLASSIFIERS: CategoryClassifiers;
+export declare const EU_LPP_PACK: CompliancePack & {
+    categoryClassifiers: CategoryClassifiers;
+    subjectKeyedCategories: string[];
+};
+//# sourceMappingURL=eu-lpp.d.ts.map

package/dist/packs/eu-lpp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"eu-lpp.d.ts","sourceRoot":"","sources":["../../src/packs/eu-lpp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,0CAA0C,CAAC;AAE/E;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,EAAE,mBAmDzC,CAAC;AAEF,eAAO,MAAM,WAAW,EAAE,cAAc,GAAG;IAAE,mBAAmB,EAAE,mBAAmB,CAAC;IAAC,sBAAsB,EAAE,MAAM,EAAE,CAAA;CAsOtH,CAAC"}

package/dist/packs/eu-lpp.js

@@ -0,0 +1,345 @@
+"use strict";
+/**
+ * EU Legal Professional Privilege Compliance Pack
+ *
+ * Governs the protection of lawyer-client communications under EU law
+ * as established by ECJ jurisprudence and reflected in member-state law.
+ *
+ * Primary authority:
+ *   - ECJ Case C-550/07 P, Akzo Nobel Chemicals v Commission (2010):
+ *     the definitive EU LPP standard. LPP applies ONLY to communications
+ *     with external lawyers who are members of an EU/EEA Bar and are
+ *     independent (not employed by the client). In-house counsel
+ *     communications are NOT privileged under EU law.
+ *   - ECJ Case C-283/05, ASML Netherlands (2006): limits scope of
+ *     LPP in cross-border proceedings.
+ *   - ECJ Case 155/79, AM&S Europe v Commission (1982): original
+ *     establishment of EU LPP doctrine; two conditions -- (1) made for
+ *     the purpose of the client's right of defence; (2) from independent
+ *     lawyers enrolled in an EU/EEA Bar.
+ *   - Member-state law varies in scope: France (secret professionnel),
+ *     Germany (Berufsgeheimnis), Netherlands (verschoningsrecht), etc.
+ *     The EU standard provides a floor; member-state law may be broader.
+ *
+ * Critical distinctions from US ABA privilege:
+ *   - In-house EU counsel are NOT privileged under Akzo Nobel -- only
+ *     external lawyers with EU/EEA Bar membership.
+ *   - Only communications made "for the purpose of the client's right
+ *     of defence" in the context of EU competition / regulatory
+ *     proceedings meet the Akzo Nobel test at EU level.
+ *   - Third-country counsel (US, UK post-Brexit, etc.) -- privilege
+ *     analysis depends on the proceedings and forum; UK solicitors
+ *     are now third-country post-Brexit for EU purposes.
+ *   - UK post-Brexit note: UK solicitors/barristers are no longer
+ *     EU/EEA Bar members. Communications with UK counsel for EU
+ *     Commission proceedings do NOT attract EU LPP. UK GDPR
+ *     domestically preserves UK LPP, but EU Commission cannot be
+ *     required to recognise it.
+ *
+ * Applicable context:
+ *   - EU Commission competition / state aid investigations
+ *   - EU Merger Regulation (EC 139/2004) Phase I/II proceedings
+ *   - EU antitrust (Art. 101/102 TFEU) investigations
+ *   - Any EU regulatory proceeding with access to legal files
+ *   - AI systems processing legal documents at EU-regulated firms
+ *
+ * @connexum/ai-governance
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EU_LPP_PACK = exports.EU_LPP_CATEGORY_CLASSIFIERS = void 0;
+/**
+ * EU Legal Professional Privilege category classifiers.
+ * Critically: in-house counsel communications are NOT privileged.
+ * The classifier flags communications that appear privileged but
+ * must separately evaluate whether the lawyer is external and
+ * EU/EEA Bar-enrolled.
+ */
+exports.EU_LPP_CATEGORY_CLASSIFIERS = {
+    EU_PRIVILEGED: {
+        references: ['ECJ C-550/07 P Akzo Nobel -- EU LPP doctrine; external EU/EEA Bar lawyer communications only'],
+        classifier: (input) => {
+            // External lawyer communications (EU LPP eligible)
+            if (/\b(?:external\s+(?:counsel|lawyer|solicitor|attorney)|outside\s+counsel)\b/i.test(input))
+                return true;
+            // EU Bar membership indicators
+            if (/\b(?:avocat|rechtsanwalt|advocaat|avvocato|abogado|advokat)\b/i.test(input))
+                return true;
+            // Privilege markers
+            if (/\b(?:legally?\s+privileged|privilege[d]?\s+and\s+confidential|attorney.?client\s+privilege)\b/i.test(input))
+                return true;
+            // Right of defence context
+            if (/\b(?:right\s+of\s+defence|EU\s+Commission\s+(?:investigation|dawn\s+raid|inspection|statement\s+of\s+objections))\b/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    IN_HOUSE_LEGAL_UNPROTECTED: {
+        references: ['ECJ C-550/07 P Akzo Nobel -- in-house counsel NOT privileged under EU LPP'],
+        classifier: (input) => {
+            // In-house counsel communications (NOT privileged under EU LPP)
+            if (/\b(?:in.?house\s+(?:counsel|lawyer|legal)|general\s+counsel|chief\s+legal\s+officer|CLO|GC\s+(?:review|opinion|advice))\b/i.test(input))
+                return true;
+            if (/\b(?:legal\s+department|legal\s+team|corporate\s+counsel|employed\s+(?:lawyer|counsel|attorney))\b/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    THIRD_COUNTRY_LEGAL_UNCERTAIN: {
+        references: ['ECJ C-550/07 P Akzo Nobel -- third-country counsel privilege uncertain in EU proceedings'],
+        classifier: (input) => {
+            // UK counsel post-Brexit (uncertain for EU Commission proceedings)
+            if (/\b(?:UK\s+(?:solicitor|barrister|counsel|law\s+firm)|English\s+(?:solicitor|barrister|law)|Scots\s+(?:law|solicitor))\b/i.test(input))
+                return true;
+            // US counsel in EU proceedings
+            if (/\b(?:US\s+counsel|American\s+(?:attorney|counsel|lawyer)|New\s+York\s+(?:attorney|counsel))\b/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    PII: {
+        references: ['GDPR Art. 4(1) -- personal data of parties in privileged communications'],
+        classifier: (input) => {
+            if (/\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b/.test(input))
+                return true;
+            if (/\b\d{3}-\d{2}-\d{4}\b/.test(input))
+                return true;
+            return false;
+        },
+    },
+    CREDENTIALS: {
+        references: ['GDPR Art. 32 -- security of processing; credential protection in legal environments'],
+        classifier: (input) => {
+            if (/\b(?:api[_-]?key|apikey)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(input))
+                return true;
+            if (/\bpassword\s*[=:]\s*["']?[A-Za-z0-9!@#$%^&*_\-]{8,}["']?/i.test(input))
+                return true;
+            if (/-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/.test(input))
+                return true;
+            return false;
+        },
+    },
+};
+exports.EU_LPP_PACK = {
+    categoryClassifiers: exports.EU_LPP_CATEGORY_CLASSIFIERS,
+    /** P3.5: Privileged communications are subject-keyed (privilege belongs to a specific client in a specific matter). */
+    subjectKeyedCategories: ['EU_PRIVILEGED'],
+    id: 'eu-lpp',
+    aliases: ['LG-05'],
+    name: 'EU Legal Professional Privilege (Akzo Nobel Standard)',
+    version: '1.0.0',
+    description: 'EU Legal Professional Privilege compliance for AI systems processing legal communications at EU-regulated entities. Implements the Akzo Nobel standard (ECJ C-550/07 P, 2010): LPP applies ONLY to external EU/EEA Bar-enrolled counsel; in-house counsel communications are NOT privileged. Covers privilege classification, in-house/external counsel detection, third-country counsel flagging, privilege breach response, and proceedings-specific LPP scope.',
+    authority: 'ECJ jurisprudence (Akzo Nobel C-550/07 P; AM&S C-155/79) + member-state bar authorities',
+    industries: ['legal', 'law-firm', 'in-house-legal', 'legal-ops', 'legal-tech', 'regulatory-affairs', 'competition-law', 'investment-banking', 'pharma', 'energy'],
+    requiredModules: [
+        {
+            name: 'data-classifier',
+            required: true,
+            reason: 'Privilege classification: detect EU_PRIVILEGED vs IN_HOUSE_LEGAL_UNPROTECTED vs THIRD_COUNTRY_LEGAL_UNCERTAIN categories; prevent misclassification of in-house communications as privileged',
+            reference: 'ECJ C-550/07 P Akzo Nobel -- two-condition EU LPP test (external Bar-enrolled lawyer + right of defence purpose)',
+        },
+        {
+            name: 'governance-runtime',
+            required: true,
+            reason: 'In-house vs external counsel detection enforcement; EU/EEA Bar membership verification gate; third-country counsel flag and privilege analysis workflow',
+            reference: 'ECJ C-550/07 P -- independence requirement; AM&S 155/79 -- enrolled in a Bar condition',
+        },
+        {
+            name: 'audit-integrity',
+            required: true,
+            reason: 'Tamper-evident record of privilege classification decisions, claw-back assertions, and privilege waiver events for potential court proceedings',
+            reference: 'ECJ LPP doctrine -- burden of proof on party asserting privilege; Commission inspection powers (Art. 17 Reg. 1/2003)',
+        },
+        {
+            name: 'approval-queue',
+            required: true,
+            reason: 'Privilege waiver gate: explicit human lawyer approval required before any EU-LPP-classified communication is disclosed; claw-back assertion approval workflow',
+            reference: 'ECJ C-550/07 P -- privilege can only be waived by the client; claw-back procedures in EU proceedings',
+        },
+        {
+            name: 'session-persistence',
+            required: true,
+            reason: 'Per-matter privilege scope isolation; privilege status preserved throughout proceedings lifecycle; waiver state tracked per matter',
+            reference: 'ECJ LPP doctrine -- privilege is matter-specific and must be maintained for the duration of the proceedings',
+        },
+        {
+            name: 'supply-chain',
+            required: true,
+            reason: 'Verify AI vendors have zero-retention and zero-training-on-inputs for communications in scope of EU LPP; vendor access to privileged documents requires EU-compliant terms',
+            reference: 'ECJ C-550/07 P -- privileged communications may not be disclosed to third parties including regulators without client consent',
+        },
+        {
+            name: 'event-bus',
+            required: true,
+            reason: 'Privilege breach events: immediate detection, isolation, and escalation when EU-LPP classified content is transmitted without approval',
+            reference: 'EU Commission Regulation 1/2003 Art. 20 -- dawn raid powers; claw-back rights; immediate privilege breach response obligation',
+        },
+        {
+            name: 'agent-auth',
+            required: true,
+            reason: 'Only authorised legal personnel may access EU-LPP classified communications; external lawyer identity verification for EU/EEA Bar membership status',
+            reference: 'ECJ C-550/07 P -- independence of counsel verified per communication',
+        },
+        {
+            name: 'attestation-manager',
+            required: true,
+            reason: 'EU/EEA Bar membership attestation per external lawyer; matter-level privilege scope documentation; claw-back assertion records',
+            reference: 'ECJ C-550/07 P -- party asserting EU LPP must demonstrate both conditions are met; written evidence required in EU proceedings',
+        },
+        {
+            name: 'transparency-injector',
+            required: true,
+            reason: 'Disclosure of third-country counsel privilege uncertainty; in-house counsel communications flagged as unprotected; AI-processed legal communications disclosure',
+            reference: 'ECJ C-550/07 P -- in-house counsel must be informed their communications are not EU-LPP protected; client awareness of AI processing in privileged matter context',
+        },
+    ],
+    moduleConfig: {
+        'data-classifier': {
+            enabledCategories: ['EU_PRIVILEGED', 'IN_HOUSE_LEGAL_UNPROTECTED', 'THIRD_COUNTRY_LEGAL_UNCERTAIN', 'PII', 'CREDENTIALS'],
+            euPrivilegedAction: 'BLOCK_UNLESS_WAIVED',
+            inHouseLegalAction: 'FLAG_AS_UNPROTECTED',
+            thirdCountryCounselAction: 'FLAG_FOR_PRIVILEGE_ANALYSIS',
+        },
+        'governance-runtime': {
+            externalBarMembershipVerificationRequired: true,
+            inHouseCounselFlaggingRequired: true,
+            thirdCountryCounselAnalysisRequired: true,
+            euLppTwoConditionTestEnforced: true,
+        },
+        'session-persistence': {
+            perMatterPrivilegeScopeRequired: true,
+            privilegeWaiverStateTracked: true,
+            proceedingsLifecycleTracking: true,
+        },
+        'supply-chain': {
+            vendorZeroRetentionRequired: true,
+            vendorZeroTrainingOnInputsRequired: true,
+            vendorPrivilegedCommunicationsTermsRequired: true,
+        },
+        'approval-queue': {
+            privilegeWaiverRequiresLawyerApproval: true,
+            clawBackAssertionApprovalRequired: true,
+            disclosureToRegulatorsGateRequired: true,
+        },
+        'attestation-manager': {
+            euEeaBarMembershipAttestationRequired: true,
+            matterPrivilegeScopeDocumentationRequired: true,
+        },
+        'transparency-injector': {
+            inHouseCounselUnprotectedNoticeRequired: true,
+            thirdCountryCounselUncertaintyDisclosureRequired: true,
+        },
+    },
+    providerPolicy: {
+        blockedProviders: ['deepseek', 'baidu', 'alibaba'],
+        requiredCapabilities: ['ZERO-RETENTION', 'ZERO-TRAINING-ON-INPUTS', 'EU-DATA-RESIDENCY'],
+        blockReasons: {
+            deepseek: 'PRC National Intelligence Law creates disclosure risk incompatible with EU LPP. EU Commission may treat AI vendor access as destruction of privilege.',
+            baidu: 'PRC jurisdiction incompatible with EU LPP confidentiality obligations. Mandatory state access laws conflict with Akzo Nobel independence requirement.',
+            alibaba: 'PRC jurisdiction incompatible with EU LPP confidentiality obligations. Mandatory state access laws conflict with Akzo Nobel independence requirement.',
+        },
+    },
+    dataPolicy: {
+        scanCategories: ['EU_PRIVILEGED', 'IN_HOUSE_LEGAL_UNPROTECTED', 'THIRD_COUNTRY_LEGAL_UNCERTAIN', 'PII', 'CREDENTIALS'],
+        categoryActions: {
+            EU_PRIVILEGED: 'BLOCK',
+            IN_HOUSE_LEGAL_UNPROTECTED: 'WARN',
+            THIRD_COUNTRY_LEGAL_UNCERTAIN: 'WARN',
+            PII: 'WARN',
+            CREDENTIALS: 'BLOCK',
+        },
+        encryptionRequired: true,
+        encryptionStandard: 'AES-256',
+        minimumClassification: 'CONFIDENTIAL',
+    },
+    retentionPolicy: {
+        // EU LPP: indefinite preservation until privilege waived or matter concluded
+        // + applicable statute of limitations for the underlying regulatory / legal matter
+        auditLogRetentionDays: 3650, // 10 years -- covers most EU regulatory limitation periods
+        sessionRetentionDays: 3650,
+        incidentRetentionDays: 3650,
+        reference: 'ECJ LPP doctrine -- privileged communications preserved until privilege waived or matter concluded; EU competition limitation periods up to 10 years (Reg. 1/2003 Art. 25)',
+        forceDelete: false,
+        requiresLegalHoldSupport: true,
+        sovereignty: ['eu'],
+    },
+    incidentPolicy: {
+        // Privilege breach: immediate isolation + claw-back assertion + court notification if already disclosed in proceedings
+        notificationDeadlineHours: 4,
+        reference: 'ECJ LPP doctrine -- immediate claw-back assertion required when privileged communication disclosed without consent; EU Commission duty to return/seal privileged documents per Art. 20(4) Reg. 1/2003',
+        requiredRecipients: ['external-eu-counsel', 'chief-legal-officer', 'eu-commission-proceedings-team'],
+        formalNotificationRequired: true,
+    },
+    validators: [
+        {
+            id: 'eu-lpp-privilege-classification',
+            description: 'EU LPP privilege classification active: EU_PRIVILEGED, IN_HOUSE_LEGAL_UNPROTECTED, THIRD_COUNTRY_LEGAL_UNCERTAIN categories enforced',
+            reference: 'ECJ C-550/07 P Akzo Nobel -- two-condition EU LPP test',
+            check: 'data_classifier_active',
+            failSeverity: 'CRITICAL',
+        },
+        {
+            id: 'eu-lpp-bar-membership-verification',
+            description: 'EU/EEA Bar membership verification gate active for external counsel communications',
+            reference: 'ECJ C-550/07 P -- enrolled in a Bar of an EU/EEA member state as condition for LPP',
+            check: 'eu_lpp_bar_membership_active',
+            failSeverity: 'CRITICAL',
+        },
+        {
+            id: 'eu-lpp-inhouse-flagging',
+            description: 'In-house counsel communications flagged as unprotected under Akzo Nobel standard',
+            reference: 'ECJ C-550/07 P -- in-house counsel do not satisfy independence requirement; not EU LPP protected',
+            check: 'eu_lpp_inhouse_flagging_active',
+            failSeverity: 'CRITICAL',
+        },
+        {
+            id: 'eu-lpp-waiver-gate',
+            description: 'Privilege waiver requires human lawyer approval; no AI-autonomous privilege waiver permitted',
+            reference: 'ECJ LPP doctrine -- privilege belongs to client; waiver is client decision made via counsel',
+            check: 'approval_queue_active',
+            failSeverity: 'CRITICAL',
+        },
+        {
+            id: 'eu-lpp-third-country-analysis',
+            description: 'Third-country counsel (UK post-Brexit, US) communications flagged for privilege analysis',
+            reference: 'ECJ C-550/07 P -- third-country Bar enrollment does not satisfy EU LPP condition in EU Commission proceedings',
+            check: 'eu_lpp_third_country_analysis_active',
+            failSeverity: 'HIGH',
+        },
+        {
+            id: 'eu-lpp-audit-trail',
+            description: 'Tamper-evident audit trail for all privilege classification decisions and waiver events',
+            reference: 'ECJ LPP doctrine -- burden of proof on party asserting privilege; documentary evidence required',
+            check: 'audit_trail_exists',
+            failSeverity: 'HIGH',
+        },
+        {
+            id: 'eu-lpp-breach-response',
+            description: 'Privilege breach immediate isolation and claw-back assertion workflow active',
+            reference: 'Art. 20(4) Regulation 1/2003 -- EU Commission must seal and return privileged documents; immediate claw-back obligation',
+            check: 'incident_reporting',
+            failSeverity: 'CRITICAL',
+        },
+        {
+            id: 'eu-lpp-vendor-terms',
+            description: 'All AI vendors have zero-retention and zero-training-on-inputs terms for EU-LPP scope communications',
+            reference: 'ECJ C-550/07 P -- vendor access to privileged communications may constitute disclosure that destroys privilege',
+            check: 'aba_vendor_terms_active',
+            failSeverity: 'HIGH',
+        },
+        {
+            id: 'eu-lpp-bar-attestation',
+            description: 'EU/EEA Bar membership attestation on file per external lawyer in scope',
+            reference: 'ECJ C-550/07 P -- enrollment in Bar of EU/EEA member state is verifiable documentary condition',
+            check: 'attestation_active',
+            failSeverity: 'HIGH',
+        },
+        {
+            id: 'eu-lpp-access-control',
+            description: 'Access to EU-LPP classified communications restricted to authorised legal personnel only',
+            reference: 'ECJ LPP doctrine -- privileged communications may not be accessed or disclosed to non-authorised parties',
+            check: 'rbac_active',
+            failSeverity: 'HIGH',
+        },
+    ],
+};
+//# sourceMappingURL=eu-lpp.js.map

package/dist/packs/eu-lpp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"eu-lpp.js","sourceRoot":"","sources":["../../src/packs/eu-lpp.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;;;AAKH;;;;;;GAMG;AACU,QAAA,2BAA2B,GAAwB;IAC9D,aAAa,EAAE;QACb,UAAU,EAAE,CAAC,8FAA8F,CAAC;QAC5G,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,mDAAmD;YACnD,IAAI,6EAA6E,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC3G,+BAA+B;YAC/B,IAAI,gEAAgE,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC9F,oBAAoB;YACpB,IAAI,gGAAgG,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC9H,2BAA2B;YAC3B,IAAI,sHAAsH,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACpJ,OAAO,KAAK,CAAC;QACf,CAAC;KACF;IACD,0BAA0B,EAAE;QAC1B,UAAU,EAAE,CAAC,2EAA2E,CAAC;QACzF,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,gEAAgE;YAChE,IAAI,4HAA4H,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC1J,IAAI,qGAAqG,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACnI,OAAO,KAAK,CAAC;QACf,CAAC;KACF;IACD,6BAA6B,EAAE;QAC7B,UAAU,EAAE,CAAC,0FAA0F,CAAC;QACxG,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,mEAAmE;YACnE,IAAI,0HAA0H,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACxJ,+BAA+B;YAC/B,IAAI,gGAAgG,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC9H,OAAO,KAAK,CAAC;QACf,CAAC;KACF;IACD,GAAG,EAAE;QACH,UAAU,EAAE,CAAC,yEAAyE,CAAC;QACvF,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,qDAAqD,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACnF,IAAI,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACrD,OAAO,KAAK,CAAC;QACf,CAAC;KACF;IACD,WAAW,EAAE;QACX,UAAU,EAAE,CAAC,qFAAqF,CAAC;QACnG,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,qEAAqE,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACnG,IAAI,2DAA2D,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACzF,IAAI,4CAA4C,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC1E,OAAO,KAAK,CAAC;QACf,CAAC;KACF;CACF,CAAC;AAEW,QAAA,WAAW,GAAoG;IAC1H,mBAAmB,EAAE,mCAA2B;IAChD,uHAAuH;IACvH,sBAAsB,EAAE,CAAC,eAAe,CAAC;IACzC,EAAE,EAAE,QAAQ;IACZ,OAAO,EAAE,CAAC,OAAO,CAAC;IAClB,IAAI,EAAE,uDAAuD;IAC7D,OAAO,EAAE,OAAO;IAChB,WAAW,EACT,mcAAmc;IACrc,SAAS,EAAE,yFAAyF;IACpG,UAAU,EAAE,CAAC,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,WAAW,EAAE,YAAY,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,QAAQ,EAAE,QAAQ,CAAC;IAEjK,eAAe,EAAE;QACf;YACE,IAAI,EAAE,iBAAiB;YACvB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,8LAA8L;YACtM,SAAS,EAAE,kHAAkH;SAC9H;QACD;YACE,IAAI,EAAE,oBAAoB;YAC1B,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,yJAAyJ;YACjK,SAAS,EAAE,wFAAwF;SACpG;QACD;YACE,IAAI,EAAE,iBAAiB;YACvB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,gJAAgJ;YACxJ,SAAS,EAAE,sHAAsH;SAClI;QACD;YACE,IAAI,EAAE,gBAAgB;YACtB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,+JAA+J;YACvK,SAAS,EAAE,sGAAsG;SAClH;QACD;YACE,IAAI,EAAE,qBAAqB;YAC3B,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,oIAAoI;YAC5I,SAAS,EAAE,6GAA6G;SACzH;QACD;YACE,IAAI,EAAE,cAAc;YACpB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,4KAA4K;YACpL,SAAS,EAAE,+HAA+H;SAC3I;QACD;YACE,IAAI,EAAE,WAAW;YACjB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,wIAAwI;YAChJ,SAAS,EAAE,+HAA+H;SAC3I;QACD;YACE,IAAI,EAAE,YAAY;YAClB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,qJAAqJ;YAC7J,SAAS,EAAE,sEAAsE;SAClF;QACD;YACE,IAAI,EAAE,qBAAqB;YAC3B,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,gIAAgI;YACxI,SAAS,EAAE,gIAAgI;SAC5I;QACD;YACE,IAAI,EAAE,uBAAuB;YAC7B,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,iKAAiK;YACzK,SAAS,EAAE,mKAAmK;SAC/K;KACF;IAED,YAAY,EAAE;QACZ,iBAAiB,EAAE;YACjB,iBAAiB,EAAE,CAAC,eAAe,EAAE,4BAA4B,EAAE,+BAA+B,EAAE,KAAK,EAAE,aAAa,CAAC;YACzH,kBAAkB,EAAE,qBAAqB;YACzC,kBAAkB,EAAE,qBAAqB;YACzC,yBAAyB,EAAE,6BAA6B;SACzD;QACD,oBAAoB,EAAE;YACpB,yCAAyC,EAAE,IAAI;YAC/C,8BAA8B,EAAE,IAAI;YACpC,mCAAmC,EAAE,IAAI;YACzC,6BAA6B,EAAE,IAAI;SACpC;QACD,qBAAqB,EAAE;YACrB,+BAA+B,EAAE,IAAI;YACrC,2BAA2B,EAAE,IAAI;YACjC,4BAA4B,EAAE,IAAI;SACnC;QACD,cAAc,EAAE;YACd,2BAA2B,EAAE,IAAI;YACjC,kCAAkC,EAAE,IAAI;YACxC,2CAA2C,EAAE,IAAI;SAClD;QACD,gBAAgB,EAAE;YAChB,qCAAqC,EAAE,IAAI;YAC3C,iCAAiC,EAAE,IAAI;YACvC,kCAAkC,EAAE,IAAI;SACzC;QACD,qBAAqB,EAAE;YACrB,qCAAqC,EAAE,IAAI;YAC3C,yCAAyC,EAAE,IAAI;SAChD;QACD,uBAAuB,EAAE;YACvB,uCAAuC,EAAE,IAAI;YAC7C,gDAAgD,EAAE,IAAI;SACvD;KACF;IAED,cAAc,EAAE;QACd,gBAAgB,EAAE,CAAC,UAAU,EAAE,OAAO,EAAE,SAAS,CAAC;QAClD,oBAAoB,EAAE,CAAC,gBAAgB,EAAE,yBAAyB,EAAE,mBAAmB,CAAC;QACxF,YAAY,EAAE;YACZ,QAAQ,EAAE,uJAAuJ;YACjK,KAAK,EAAE,uJAAuJ;YAC9J,OAAO,EAAE,uJAAuJ;SACjK;KACF;IAED,UAAU,EAAE;QACV,cAAc,EAAE,CAAC,eAAe,EAAE,4BAA4B,EAAE,+BAA+B,EAAE,KAAK,EAAE,aAAa,CAAC;QACtH,eAAe,EAAE;YACf,aAAa,EAAE,OAAO;YACtB,0BAA0B,EAAE,MAAM;YAClC,6BAA6B,EAAE,MAAM;YACrC,GAAG,EAAE,MAAM;YACX,WAAW,EAAE,OAAO;SACrB;QACD,kBAAkB,EAAE,IAAI;QACxB,kBAAkB,EAAE,SAAS;QAC7B,qBAAqB,EAAE,cAAc;KACtC;IAED,eAAe,EAAE;QACf,6EAA6E;QAC7E,mFAAmF;QACnF,qBAAqB,EAAE,IAAI,EAAE,2DAA2D;QACxF,oBAAoB,EAAE,IAAI;QAC1B,qBAAqB,EAAE,IAAI;QAC3B,SAAS,EAAE,4KAA4K;QACvL,WAAW,EAAE,KAAK;QAClB,wBAAwB,EAAE,IAAI;QAC9B,WAAW,EAAE,CAAC,IAAI,CAAC;KACpB;IAED,cAAc,EAAE;QACd,uHAAuH;QACvH,yBAAyB,EAAE,CAAC;QAC5B,SAAS,EAAE,uMAAuM;QAClN,kBAAkB,EAAE,CAAC,qBAAqB,EAAE,qBAAqB,EAAE,gCAAgC,CAAC;QACpG,0BAA0B,EAAE,IAAI;KACjC;IAED,UAAU,EAAE;QACV;YACE,EAAE,EAAE,iCAAiC;YACrC,WAAW,EAAE,sIAAsI;YACnJ,SAAS,EAAE,wDAAwD;YACnE,KAAK,EAAE,wBAAwB;YAC/B,YAAY,EAAE,UAAU;SACzB;QACD;YACE,EAAE,EAAE,oCAAoC;YACxC,WAAW,EAAE,oFAAoF;YACjG,SAAS,EAAE,oFAAoF;YAC/F,KAAK,EAAE,8BAA8B;YACrC,YAAY,EAAE,UAAU;SACzB;QACD;YACE,EAAE,EAAE,yBAAyB;YAC7B,WAAW,EAAE,kFAAkF;YAC/F,SAAS,EAAE,kGAAkG;YAC7G,KAAK,EAAE,gCAAgC;YACvC,YAAY,EAAE,UAAU;SACzB;QACD;YACE,EAAE,EAAE,oBAAoB;YACxB,WAAW,EAAE,8FAA8F;YAC3G,SAAS,EAAE,6FAA6F;YACxG,KAAK,EAAE,uBAAuB;YAC9B,YAAY,EAAE,UAAU;SACzB;QACD;YACE,EAAE,EAAE,+BAA+B;YACnC,WAAW,EAAE,0FAA0F;YACvG,SAAS,EAAE,+GAA+G;YAC1H,KAAK,EAAE,sCAAsC;YAC7C,YAAY,EAAE,MAAM;SACrB;QACD;YACE,EAAE,EAAE,oBAAoB;YACxB,WAAW,EAAE,yFAAyF;YACtG,SAAS,EAAE,iGAAiG;YAC5G,KAAK,EAAE,oBAAoB;YAC3B,YAAY,EAAE,MAAM;SACrB;QACD;YACE,EAAE,EAAE,wBAAwB;YAC5B,WAAW,EAAE,8EAA8E;YAC3F,SAAS,EAAE,yHAAyH;YACpI,KAAK,EAAE,oBAAoB;YAC3B,YAAY,EAAE,UAAU;SACzB;QACD;YACE,EAAE,EAAE,qBAAqB;YACzB,WAAW,EAAE,sGAAsG;YACnH,SAAS,EAAE,gHAAgH;YAC3H,KAAK,EAAE,yBAAyB;YAChC,YAAY,EAAE,MAAM;SACrB;QACD;YACE,EAAE,EAAE,wBAAwB;YAC5B,WAAW,EAAE,wEAAwE;YACrF,SAAS,EAAE,gGAAgG;YAC3G,KAAK,EAAE,oBAAoB;YAC3B,YAAY,EAAE,MAAM;SACrB;QACD;YACE,EAAE,EAAE,uBAAuB;YAC3B,WAAW,EAAE,0FAA0F;YACvG,SAAS,EAAE,0GAA0G;YACrH,KAAK,EAAE,aAAa;YACpB,YAAY,EAAE,MAAM;SACrB;KACF;CACF,CAAC"}