/**
 * EU Legal Professional Privilege Compliance Pack
 *
 * Governs the protection of lawyer-client communications under EU law
 * as established by ECJ jurisprudence and reflected in member-state law.
 *
 * Primary authority:
 *   - ECJ Case C-550/07 P, Akzo Nobel Chemicals v Commission (2010):
 *     the definitive EU LPP standard. LPP applies ONLY to communications
 *     with external lawyers who are members of an EU/EEA Bar and are
 *     independent (not employed by the client). In-house counsel
 *     communications are NOT privileged under EU law.
 *   - ECJ Case C-283/05, ASML Netherlands (2006): limits scope of
 *     LPP in cross-border proceedings.
 *   - ECJ Case 155/79, AM&S Europe v Commission (1982): original
 *     establishment of EU LPP doctrine; two conditions -- (1) made for
 *     the purpose of the client's right of defence; (2) from independent
 *     lawyers enrolled in an EU/EEA Bar.
 *   - Member-state law varies in scope: France (secret professionnel),
 *     Germany (Berufsgeheimnis), Netherlands (verschoningsrecht), etc.
 *     The EU standard provides a floor; member-state law may be broader.
 *
 * Critical distinctions from US ABA privilege:
 *   - In-house EU counsel are NOT privileged under Akzo Nobel -- only
 *     external lawyers with EU/EEA Bar membership.
 *   - Only communications made "for the purpose of the client's right
 *     of defence" in the context of EU competition / regulatory
 *     proceedings meet the Akzo Nobel test at EU level.
 *   - Third-country counsel (US, UK post-Brexit, etc.) -- privilege
 *     analysis depends on the proceedings and forum; UK solicitors
 *     are now third-country post-Brexit for EU purposes.
 *   - UK post-Brexit note: UK solicitors/barristers are no longer
 *     EU/EEA Bar members. Communications with UK counsel for EU
 *     Commission proceedings do NOT attract EU LPP. UK GDPR
 *     domestically preserves UK LPP, but EU Commission cannot be
 *     required to recognise it.
 *
 * Applicable context:
 *   - EU Commission competition / state aid investigations
 *   - EU Merger Regulation (EC 139/2004) Phase I/II proceedings
 *   - EU antitrust (Art. 101/102 TFEU) investigations
 *   - Any EU regulatory proceeding with access to legal files
 *   - AI systems processing legal documents at EU-regulated firms
 *
 * @connexum/ai-governance
 */
/**
 * EU Legal Professional Privilege category classifiers.
 * Critically: in-house counsel communications are NOT privileged.
 * The classifier flags communications that appear privileged but
 * must separately evaluate whether the lawyer is external and
 * EU/EEA Bar-enrolled.
 */
export const EU_LPP_CATEGORY_CLASSIFIERS = {
    EU_PRIVILEGED: {
        references: ['ECJ C-550/07 P Akzo Nobel -- EU LPP doctrine; external EU/EEA Bar lawyer communications only'],
        classifier: (input) => {
            // External lawyer communications (EU LPP eligible)
            if (/\b(?:external\s+(?:counsel|lawyer|solicitor|attorney)|outside\s+counsel)\b/i.test(input))
                return true;
            // EU Bar membership indicators
            if (/\b(?:avocat|rechtsanwalt|advocaat|avvocato|abogado|advokat)\b/i.test(input))
                return true;
            // Privilege markers
            if (/\b(?:legally?\s+privileged|privilege[d]?\s+and\s+confidential|attorney.?client\s+privilege)\b/i.test(input))
                return true;
            // Right of defence context
            if (/\b(?:right\s+of\s+defence|EU\s+Commission\s+(?:investigation|dawn\s+raid|inspection|statement\s+of\s+objections))\b/i.test(input))
                return true;
            return false;
        },
    },
    IN_HOUSE_LEGAL_UNPROTECTED: {
        references: ['ECJ C-550/07 P Akzo Nobel -- in-house counsel NOT privileged under EU LPP'],
        classifier: (input) => {
            // In-house counsel communications (NOT privileged under EU LPP)
            if (/\b(?:in.?house\s+(?:counsel|lawyer|legal)|general\s+counsel|chief\s+legal\s+officer|CLO|GC\s+(?:review|opinion|advice))\b/i.test(input))
                return true;
            if (/\b(?:legal\s+department|legal\s+team|corporate\s+counsel|employed\s+(?:lawyer|counsel|attorney))\b/i.test(input))
                return true;
            return false;
        },
    },
    THIRD_COUNTRY_LEGAL_UNCERTAIN: {
        references: ['ECJ C-550/07 P Akzo Nobel -- third-country counsel privilege uncertain in EU proceedings'],
        classifier: (input) => {
            // UK counsel post-Brexit (uncertain for EU Commission proceedings)
            if (/\b(?:UK\s+(?:solicitor|barrister|counsel|law\s+firm)|English\s+(?:solicitor|barrister|law)|Scots\s+(?:law|solicitor))\b/i.test(input))
                return true;
            // US counsel in EU proceedings
            if (/\b(?:US\s+counsel|American\s+(?:attorney|counsel|lawyer)|New\s+York\s+(?:attorney|counsel))\b/i.test(input))
                return true;
            return false;
        },
    },
    PII: {
        references: ['GDPR Art. 4(1) -- personal data of parties in privileged communications'],
        classifier: (input) => {
            if (/\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b/.test(input))
                return true;
            if (/\b\d{3}-\d{2}-\d{4}\b/.test(input))
                return true;
            return false;
        },
    },
    CREDENTIALS: {
        references: ['GDPR Art. 32 -- security of processing; credential protection in legal environments'],
        classifier: (input) => {
            if (/\b(?:api[_-]?key|apikey)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(input))
                return true;
            if (/\bpassword\s*[=:]\s*["']?[A-Za-z0-9!@#$%^&*_\-]{8,}["']?/i.test(input))
                return true;
            if (/-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/.test(input))
                return true;
            return false;
        },
    },
};
export const EU_LPP_PACK = {
    categoryClassifiers: EU_LPP_CATEGORY_CLASSIFIERS,
    /** P3.5: Privileged communications are subject-keyed (privilege belongs to a specific client in a specific matter). */
    subjectKeyedCategories: ['EU_PRIVILEGED'],
    id: 'eu-lpp',
    aliases: ['LG-05'],
    name: 'EU Legal Professional Privilege (Akzo Nobel Standard)',
    version: '1.0.0',
    contentHash: 'b6d419273901a2248f7d2e9834d206f82b322d9ac93a75c7e1b491290a0f4eb1',
    description: 'EU Legal Professional Privilege compliance for AI systems processing legal communications at EU-regulated entities. Implements the Akzo Nobel standard (ECJ C-550/07 P, 2010): LPP applies ONLY to external EU/EEA Bar-enrolled counsel; in-house counsel communications are NOT privileged. Covers privilege classification, in-house/external counsel detection, third-country counsel flagging, privilege breach response, and proceedings-specific LPP scope.',
    authority: 'ECJ jurisprudence (Akzo Nobel C-550/07 P; AM&S C-155/79) + member-state bar authorities',
    industries: ['legal', 'law-firm', 'in-house-legal', 'legal-ops', 'legal-tech', 'regulatory-affairs', 'competition-law', 'investment-banking', 'pharma', 'energy'],
    requiredModules: [
        {
            name: 'data-classifier',
            required: true,
            reason: 'Privilege classification: detect EU_PRIVILEGED vs IN_HOUSE_LEGAL_UNPROTECTED vs THIRD_COUNTRY_LEGAL_UNCERTAIN categories; prevent misclassification of in-house communications as privileged',
            reference: 'ECJ C-550/07 P Akzo Nobel -- two-condition EU LPP test (external Bar-enrolled lawyer + right of defence purpose)',
        },
        {
            name: 'governance-runtime',
            required: true,
            reason: 'In-house vs external counsel detection enforcement; EU/EEA Bar membership verification gate; third-country counsel flag and privilege analysis workflow',
            reference: 'ECJ C-550/07 P -- independence requirement; AM&S 155/79 -- enrolled in a Bar condition',
        },
        {
            name: 'audit-integrity',
            required: true,
            reason: 'Tamper-evident record of privilege classification decisions, claw-back assertions, and privilege waiver events for potential court proceedings',
            reference: 'ECJ LPP doctrine -- burden of proof on party asserting privilege; Commission inspection powers (Art. 17 Reg. 1/2003)',
        },
        {
            name: 'approval-queue',
            required: true,
            reason: 'Privilege waiver gate: explicit human lawyer approval required before any EU-LPP-classified communication is disclosed; claw-back assertion approval workflow',
            reference: 'ECJ C-550/07 P -- privilege can only be waived by the client; claw-back procedures in EU proceedings',
        },
        {
            name: 'session-persistence',
            required: true,
            reason: 'Per-matter privilege scope isolation; privilege status preserved throughout proceedings lifecycle; waiver state tracked per matter',
            reference: 'ECJ LPP doctrine -- privilege is matter-specific and must be maintained for the duration of the proceedings',
        },
        {
            name: 'supply-chain',
            required: true,
            reason: 'Verify AI vendors have zero-retention and zero-training-on-inputs for communications in scope of EU LPP; vendor access to privileged documents requires EU-compliant terms',
            reference: 'ECJ C-550/07 P -- privileged communications may not be disclosed to third parties including regulators without client consent',
        },
        {
            name: 'event-bus',
            required: true,
            reason: 'Privilege breach events: immediate detection, isolation, and escalation when EU-LPP classified content is transmitted without approval',
            reference: 'EU Commission Regulation 1/2003 Art. 20 -- dawn raid powers; claw-back rights; immediate privilege breach response obligation',
        },
        {
            name: 'agent-auth',
            required: true,
            reason: 'Only authorised legal personnel may access EU-LPP classified communications; external lawyer identity verification for EU/EEA Bar membership status',
            reference: 'ECJ C-550/07 P -- independence of counsel verified per communication',
        },
        {
            name: 'attestation-manager',
            required: true,
            reason: 'EU/EEA Bar membership attestation per external lawyer; matter-level privilege scope documentation; claw-back assertion records',
            reference: 'ECJ C-550/07 P -- party asserting EU LPP must demonstrate both conditions are met; written evidence required in EU proceedings',
        },
        {
            name: 'transparency-injector',
            required: true,
            reason: 'Disclosure of third-country counsel privilege uncertainty; in-house counsel communications flagged as unprotected; AI-processed legal communications disclosure',
            reference: 'ECJ C-550/07 P -- in-house counsel must be informed their communications are not EU-LPP protected; client awareness of AI processing in privileged matter context',
        },
    ],
    moduleConfig: {
        'data-classifier': {
            enabledCategories: ['EU_PRIVILEGED', 'IN_HOUSE_LEGAL_UNPROTECTED', 'THIRD_COUNTRY_LEGAL_UNCERTAIN', 'PII', 'CREDENTIALS'],
            euPrivilegedAction: 'BLOCK_UNLESS_WAIVED',
            inHouseLegalAction: 'FLAG_AS_UNPROTECTED',
            thirdCountryCounselAction: 'FLAG_FOR_PRIVILEGE_ANALYSIS',
        },
        'governance-runtime': {
            externalBarMembershipVerificationRequired: true,
            inHouseCounselFlaggingRequired: true,
            thirdCountryCounselAnalysisRequired: true,
            euLppTwoConditionTestEnforced: true,
        },
        'session-persistence': {
            perMatterPrivilegeScopeRequired: true,
            privilegeWaiverStateTracked: true,
            proceedingsLifecycleTracking: true,
        },
        'supply-chain': {
            vendorZeroRetentionRequired: true,
            vendorZeroTrainingOnInputsRequired: true,
            vendorPrivilegedCommunicationsTermsRequired: true,
        },
        'approval-queue': {
            privilegeWaiverRequiresLawyerApproval: true,
            clawBackAssertionApprovalRequired: true,
            disclosureToRegulatorsGateRequired: true,
        },
        'attestation-manager': {
            euEeaBarMembershipAttestationRequired: true,
            matterPrivilegeScopeDocumentationRequired: true,
        },
        'transparency-injector': {
            inHouseCounselUnprotectedNoticeRequired: true,
            thirdCountryCounselUncertaintyDisclosureRequired: true,
        },
    },
    providerPolicy: {
        blockedProviders: ['deepseek', 'baidu', 'alibaba'],
        requiredCapabilities: ['ZERO-RETENTION', 'ZERO-TRAINING-ON-INPUTS', 'EU-DATA-RESIDENCY'],
        blockReasons: {
            deepseek: 'PRC National Intelligence Law creates disclosure risk incompatible with EU LPP. EU Commission may treat AI vendor access as destruction of privilege.',
            baidu: 'PRC jurisdiction incompatible with EU LPP confidentiality obligations. Mandatory state access laws conflict with Akzo Nobel independence requirement.',
            alibaba: 'PRC jurisdiction incompatible with EU LPP confidentiality obligations. Mandatory state access laws conflict with Akzo Nobel independence requirement.',
        },
    },
    dataPolicy: {
        scanCategories: ['EU_PRIVILEGED', 'IN_HOUSE_LEGAL_UNPROTECTED', 'THIRD_COUNTRY_LEGAL_UNCERTAIN', 'PII', 'CREDENTIALS'],
        categoryActions: {
            EU_PRIVILEGED: 'BLOCK',
            IN_HOUSE_LEGAL_UNPROTECTED: 'WARN',
            THIRD_COUNTRY_LEGAL_UNCERTAIN: 'WARN',
            PII: 'WARN',
            CREDENTIALS: 'BLOCK',
        },
        encryptionRequired: true,
        encryptionStandard: 'AES-256',
        minimumClassification: 'CONFIDENTIAL',
    },
    retentionPolicy: {
        // EU LPP: indefinite preservation until privilege waived or matter concluded
        // + applicable statute of limitations for the underlying regulatory / legal matter
        auditLogRetentionDays: 3650, // 10 years -- covers most EU regulatory limitation periods
        sessionRetentionDays: 3650,
        incidentRetentionDays: 3650,
        reference: 'ECJ LPP doctrine -- privileged communications preserved until privilege waived or matter concluded; EU competition limitation periods up to 10 years (Reg. 1/2003 Art. 25)',
        forceDelete: false,
        requiresLegalHoldSupport: true,
        sovereignty: ['eu'],
    },
    incidentPolicy: {
        // Privilege breach: immediate isolation + claw-back assertion + court notification if already disclosed in proceedings
        notificationDeadlineHours: 4,
        reference: 'ECJ LPP doctrine -- immediate claw-back assertion required when privileged communication disclosed without consent; EU Commission duty to return/seal privileged documents per Art. 20(4) Reg. 1/2003',
        requiredRecipients: ['external-eu-counsel', 'chief-legal-officer', 'eu-commission-proceedings-team'],
        formalNotificationRequired: true,
    },
    validators: [
        {
            id: 'eu-lpp-privilege-classification',
            description: 'EU LPP privilege classification active: EU_PRIVILEGED, IN_HOUSE_LEGAL_UNPROTECTED, THIRD_COUNTRY_LEGAL_UNCERTAIN categories enforced',
            reference: 'ECJ C-550/07 P Akzo Nobel -- two-condition EU LPP test',
            check: 'data_classifier_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'eu-lpp-bar-membership-verification',
            description: 'EU/EEA Bar membership verification gate active for external counsel communications',
            reference: 'ECJ C-550/07 P -- enrolled in a Bar of an EU/EEA member state as condition for LPP',
            check: 'eu_lpp_bar_membership_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'eu-lpp-inhouse-flagging',
            description: 'In-house counsel communications flagged as unprotected under Akzo Nobel standard',
            reference: 'ECJ C-550/07 P -- in-house counsel do not satisfy independence requirement; not EU LPP protected',
            check: 'eu_lpp_inhouse_flagging_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'eu-lpp-waiver-gate',
            description: 'Privilege waiver requires human lawyer approval; no AI-autonomous privilege waiver permitted',
            reference: 'ECJ LPP doctrine -- privilege belongs to client; waiver is client decision made via counsel',
            check: 'approval_queue_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'eu-lpp-third-country-analysis',
            description: 'Third-country counsel (UK post-Brexit, US) communications flagged for privilege analysis',
            reference: 'ECJ C-550/07 P -- third-country Bar enrollment does not satisfy EU LPP condition in EU Commission proceedings',
            check: 'eu_lpp_third_country_analysis_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'eu-lpp-audit-trail',
            description: 'Tamper-evident audit trail for all privilege classification decisions and waiver events',
            reference: 'ECJ LPP doctrine -- burden of proof on party asserting privilege; documentary evidence required',
            check: 'audit_trail_exists',
            failSeverity: 'HIGH',
        },
        {
            id: 'eu-lpp-breach-response',
            description: 'Privilege breach immediate isolation and claw-back assertion workflow active',
            reference: 'Art. 20(4) Regulation 1/2003 -- EU Commission must seal and return privileged documents; immediate claw-back obligation',
            check: 'incident_reporting',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'eu-lpp-vendor-terms',
            description: 'All AI vendors have zero-retention and zero-training-on-inputs terms for EU-LPP scope communications',
            reference: 'ECJ C-550/07 P -- vendor access to privileged communications may constitute disclosure that destroys privilege',
            check: 'aba_vendor_terms_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'eu-lpp-bar-attestation',
            description: 'EU/EEA Bar membership attestation on file per external lawyer in scope',
            reference: 'ECJ C-550/07 P -- enrollment in Bar of EU/EEA member state is verifiable documentary condition',
            check: 'attestation_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'eu-lpp-access-control',
            description: 'Access to EU-LPP classified communications restricted to authorised legal personnel only',
            reference: 'ECJ LPP doctrine -- privileged communications may not be accessed or disclosed to non-authorised parties',
            check: 'rbac_active',
            failSeverity: 'HIGH',
        },
    ],
};
//# sourceMappingURL=eu-lpp.js.map