deliverd-screen 0.1.0__tar.gz

deliverd_screen-0.1.0/.gitignore

@@ -0,0 +1,16 @@
+node_modules/
+.pnpm-store/
+dist/
+*.tsbuildinfo
+coverage/
+.DS_Store
+
+# packages/sdk-rust
+packages/sdk-rust/target/
+
+# packages/sdk-python
+__pycache__/
+*.py[cod]
+.pytest_cache/
+.venv/
+*.egg-info/

deliverd_screen-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Deliverd
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

deliverd_screen-0.1.0/PKG-INFO

@@ -0,0 +1,84 @@
+Metadata-Version: 2.5
+Name: deliverd-screen
+Version: 0.1.0
+Summary: A pre-send check for every prompt. Finds and redacts personal data, secrets and your own confidential terms before text goes to an AI model. Runs locally, no account, no network calls.
+Project-URL: Homepage, https://deliverd.dev/docs/developers/screen?utm_source=pypi&utm_medium=package&utm_campaign=screen&utm_content=metadata
+Project-URL: Source, https://github.com/deliverd-dev/deliverd-sdk/tree/main/packages/screen-python
+Project-URL: Changelog, https://github.com/deliverd-dev/deliverd-sdk/blob/main/packages/screen-python/CHANGELOG.md
+License-Expression: MIT
+License-File: LICENSE
+Keywords: ai,deliverd,dlp,gdpr,llm,pii,privacy,prompt,redaction
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Programming Language :: Python :: 3.9
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Topic :: Scientific/Engineering :: Artificial Intelligence
+Classifier: Topic :: Security
+Classifier: Typing :: Typed
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+
+# Deliverd Screen for Python
+
+**A pre-send check for every prompt.** Find and redact personal data, secrets
+and your own confidential terms before text goes to an AI model.
+
+It runs locally, with no account, no key and no network call. It needs no dependencies
+and works on Python 3.9 and up. MIT.
+
+```bash
+pip install deliverd-screen
+```
+
+```python
+from deliverd_screen import screen
+
+checked = screen("Reply to mary.byrne@example.ie about IBAN IE29AIBK93115212345678")
+checked.verdict  # "redact"
+checked.text     # "Reply to [EMAIL_1] about IBAN [IBAN_1]"
+
+answer = model.generate(checked.text)
+checked.restore(answer)  # the real values, back in the answer
+```
+
+`allow` sends the original; `redact` sends placeholders in place of what the
+model may not receive; `ask` means a person has to decide; `deny` sends nothing.
+By default a model may receive internal data and no personal data. Pass
+`personal_data=True, classification="confidential"` for one approved for more.
+
+## Names: plug in a model
+
+```python
+from transformers import pipeline
+from deliverd_screen.adapters import token_classifier, presidio
+
+ner = pipeline("token-classification", model="dslim/bert-base-NER", aggregation_strategy="simple")
+checked = screen(prompt, detectors=[token_classifier(ner)])
+
+# or Presidio, in process:
+from presidio_analyzer import AnalyzerEngine
+checked = screen(prompt, detectors=[presidio(AnalyzerEngine())])
+```
+
+Any model with the same output works, including Perplexity's PII-Tracer and
+GLiNER. Check its licence before you ship it.
+
+## CLI
+
+```bash
+cat prompt.txt | deliverd-screen --redact
+deliverd-screen --fail --json fixtures/*.json
+```
+
+## A net, not a certificate
+
+Structured identifiers are found well. Names are found only as well as the
+model you plug in, and redacted text about a person is still personal data
+under GDPR.
+
+When a person has to decide, [Deliverd](https://deliverd.dev/docs/developers/screen?utm_source=pypi&utm_medium=package&utm_campaign=screen&utm_content=readme)'s
+Data Gate asks them. `deliverd.screen()` in the `deliverd` SDK runs these
+same detectors and sends only counts. It takes the same `detectors`.

deliverd_screen-0.1.0/README.md

@@ -0,0 +1,61 @@
+# Deliverd Screen for Python
+
+**A pre-send check for every prompt.** Find and redact personal data, secrets
+and your own confidential terms before text goes to an AI model.
+
+It runs locally, with no account, no key and no network call. It needs no dependencies
+and works on Python 3.9 and up. MIT.
+
+```bash
+pip install deliverd-screen
+```
+
+```python
+from deliverd_screen import screen
+
+checked = screen("Reply to mary.byrne@example.ie about IBAN IE29AIBK93115212345678")
+checked.verdict  # "redact"
+checked.text     # "Reply to [EMAIL_1] about IBAN [IBAN_1]"
+
+answer = model.generate(checked.text)
+checked.restore(answer)  # the real values, back in the answer
+```
+
+`allow` sends the original; `redact` sends placeholders in place of what the
+model may not receive; `ask` means a person has to decide; `deny` sends nothing.
+By default a model may receive internal data and no personal data. Pass
+`personal_data=True, classification="confidential"` for one approved for more.
+
+## Names: plug in a model
+
+```python
+from transformers import pipeline
+from deliverd_screen.adapters import token_classifier, presidio
+
+ner = pipeline("token-classification", model="dslim/bert-base-NER", aggregation_strategy="simple")
+checked = screen(prompt, detectors=[token_classifier(ner)])
+
+# or Presidio, in process:
+from presidio_analyzer import AnalyzerEngine
+checked = screen(prompt, detectors=[presidio(AnalyzerEngine())])
+```
+
+Any model with the same output works, including Perplexity's PII-Tracer and
+GLiNER. Check its licence before you ship it.
+
+## CLI
+
+```bash
+cat prompt.txt | deliverd-screen --redact
+deliverd-screen --fail --json fixtures/*.json
+```
+
+## A net, not a certificate
+
+Structured identifiers are found well. Names are found only as well as the
+model you plug in, and redacted text about a person is still personal data
+under GDPR.
+
+When a person has to decide, [Deliverd](https://deliverd.dev/docs/developers/screen?utm_source=pypi&utm_medium=package&utm_campaign=screen&utm_content=readme)'s
+Data Gate asks them. `deliverd.screen()` in the `deliverd` SDK runs these
+same detectors and sends only counts. It takes the same `detectors`.

deliverd_screen-0.1.0/pyproject.toml

@@ -0,0 +1,43 @@
+[build-system]
+requires = ["hatchling>=1.27"]
+build-backend = "hatchling.build"
+
+[project]
+name = "deliverd-screen"
+version = "0.1.0"
+description = "A pre-send check for every prompt. Finds and redacts personal data, secrets and your own confidential terms before text goes to an AI model. Runs locally, no account, no network calls."
+readme = "README.md"
+license = "MIT"
+license-files = ["LICENSE"]
+requires-python = ">=3.9"
+keywords = ["pii", "redaction", "privacy", "dlp", "llm", "prompt", "ai", "gdpr", "deliverd"]
+classifiers = [
+  "Development Status :: 4 - Beta",
+  "Intended Audience :: Developers",
+  "Operating System :: OS Independent",
+  "Programming Language :: Python :: 3",
+  "Programming Language :: Python :: 3 :: Only",
+  "Programming Language :: Python :: 3.9",
+  "Programming Language :: Python :: 3.14",
+  "Topic :: Security",
+  "Topic :: Scientific/Engineering :: Artificial Intelligence",
+  "Typing :: Typed",
+]
+# None. The detectors are the standard library's re; a model for names is
+# yours to install and pass in (deliverd_screen.adapters).
+dependencies = []
+
+[project.scripts]
+deliverd-screen = "deliverd_screen.cli:main"
+
+[project.urls]
+Homepage = "https://deliverd.dev/docs/developers/screen?utm_source=pypi&utm_medium=package&utm_campaign=screen&utm_content=metadata"
+Source = "https://github.com/deliverd-dev/deliverd-sdk/tree/main/packages/screen-python"
+Changelog = "https://github.com/deliverd-dev/deliverd-sdk/blob/main/packages/screen-python/CHANGELOG.md"
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/deliverd_screen"]
+artifacts = ["src/deliverd_screen/py.typed"]
+
+[tool.hatch.build.targets.sdist]
+include = ["src/deliverd_screen", "README.md", "LICENSE"]

deliverd_screen-0.1.0/src/deliverd_screen/__init__.py

@@ -0,0 +1,168 @@
+"""Deliverd Screen: a pre-send check for every prompt.
+
+    from deliverd_screen import screen
+
+    checked = screen(prompt)
+    if not checked.allowed:
+        raise RuntimeError(" ".join(checked.reasons))
+    answer = model.generate(checked.text)
+    return checked.restore(answer)
+
+Everything runs here. Nothing is sent anywhere: no account, no key, no network
+call. The detectors are the same rules Deliverd's servers and SDKs run, held to
+the shared vectors in ``packages/conformance``.
+
+Patterns find structured identifiers well and people's names hardly at all.
+Plug in a model for names with ``detectors``; :mod:`deliverd_screen.adapters`
+turns a Hugging Face pipeline or a Presidio analyzer into one.
+
+A net, not a guarantee. Never tell anyone a text is clean because this allowed
+it; pseudonymised text is still personal data in law.
+
+When a person has to decide (``ask``), nobody here can: Deliverd's Data Gate
+takes the policy from your AI register, asks the right person and keeps the
+record. ``deliverd.screen()`` in the ``deliverd`` package takes the same
+``detectors``.
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+from typing import Callable, Dict, List, Mapping, Optional, Sequence
+
+from .data_screen import (
+    DATA_KIND_KEYS,
+    DATA_KINDS,
+    DEFAULT_SCREEN_POLICY,
+    SCREEN_CLASSIFICATIONS,
+    DetectedSpan,
+    Redaction,
+    ScreenFinding,
+    ScreenTarget,
+    ScreenTerm,
+    assess_counts,
+    describe_counts,
+    redact,
+    redact_for,
+    restore,
+    screen_text,
+    summarise,
+    term_classification_of,
+)
+
+__version__ = "0.1.0"
+
+#: A detector: a callable from the text to spans (``DetectedSpan`` or dicts of kind, start, end).
+SpanDetector = Callable[[str], Sequence[object]]
+
+_ASK_REASON = (
+    "A person has to decide whether this may be sent, and nobody can be asked from here. "
+    "Deliverd's Data Gate routes the question to one: https://deliverd.dev/docs/developers/screen"
+)
+
+
+@dataclass
+class Screened:
+    """What may be sent, and why."""
+
+    verdict: str
+    #: Whether to send ``text``. False for a deny, and for an ask: nobody here can say yes.
+    allowed: bool
+    #: The original, the redacted text, or None when nothing may be sent.
+    text: Optional[str]
+    #: The redacted text, also for an ask, to show whoever decides. None for a deny.
+    redacted: Optional[str]
+    findings: List[ScreenFinding]
+    #: How many of each kind: all Deliverd's Data Gate is ever sent.
+    counts: Dict[str, int]
+    reasons: List[str]
+    #: Placeholder to original value. Yours alone; never sent anywhere.
+    replacements: Dict[str, str] = field(default_factory=dict)
+
+    def restore(self, answer: str) -> str:
+        """Put the original values back into text a model wrote using the placeholders."""
+        return restore(answer, self.replacements)
+
+    def __bool__(self) -> bool:
+        return self.allowed
+
+
+def detect(
+    text: str,
+    terms: Sequence[object] = (),
+    detectors: Sequence[SpanDetector] = (),
+    spans: Sequence[object] = (),
+) -> "tuple[List[ScreenFinding], Dict[str, int]]":
+    """Find what is in a text: the findings and their counts, no verdict."""
+    found = list(spans)
+    for d in detectors:
+        found.extend(d(text))
+    findings = screen_text(text, terms, found)
+    return findings, summarise(findings)
+
+
+def screen(
+    text: str,
+    *,
+    model: str = "the model",
+    classification: str = "internal",
+    personal_data: bool = False,
+    policy: Optional[Mapping[str, object]] = None,
+    terms: Sequence[object] = (),
+    detectors: Sequence[SpanDetector] = (),
+    spans: Sequence[object] = (),
+) -> Screened:
+    """Check text before it goes to a model, and decide what may be sent.
+
+    ``classification`` and ``personal_data`` say what the model may receive.
+    ``allow`` sends it as it is; ``redact`` replaces what it may not receive
+    with placeholders, and :meth:`Screened.restore` puts them back in the
+    answer; ``ask`` needs a person; ``deny`` sends nothing.
+    """
+    findings, counts = detect(text, terms, detectors, spans)
+    p = dict(policy or {})
+    p.pop("unregistered", None)
+    a = assess_counts(
+        counts,
+        ScreenTarget(name=model, approved_classification=classification, personal_data=personal_data),
+        p,
+        term_classification_of(findings),
+    )
+    redaction = redact_for(text, findings, a.verdict, a.offending)
+    if a.verdict == "allow":
+        sent: Optional[str] = text
+    elif a.verdict == "redact":
+        sent = redaction.text if redaction else None
+    else:
+        sent = None
+    return Screened(
+        verdict=a.verdict,
+        allowed=sent is not None,
+        text=sent,
+        redacted=text if a.verdict == "allow" else (redaction.text if redaction else None),
+        findings=findings,
+        counts=counts,
+        reasons=a.reasons + [_ASK_REASON] if a.verdict == "ask" else a.reasons,
+        replacements=dict(redaction.replacements) if redaction and a.verdict == "redact" else {},
+    )
+
+
+__all__ = [
+    "screen",
+    "detect",
+    "Screened",
+    "SpanDetector",
+    "DetectedSpan",
+    "ScreenFinding",
+    "ScreenTerm",
+    "Redaction",
+    "screen_text",
+    "summarise",
+    "redact",
+    "restore",
+    "describe_counts",
+    "DATA_KINDS",
+    "DATA_KIND_KEYS",
+    "SCREEN_CLASSIFICATIONS",
+    "DEFAULT_SCREEN_POLICY",
+]

deliverd_screen-0.1.0/src/deliverd_screen/__main__.py

@@ -0,0 +1,3 @@
+from .cli import main
+
+raise SystemExit(main())

deliverd_screen-0.1.0/src/deliverd_screen/adapters.py

@@ -0,0 +1,121 @@
+"""Detectors to plug in beside the patterns, for what patterns cannot find:
+people's names above all.
+
+Each adapter returns a callable from the text to spans, for
+``screen(text, detectors=[...])`` here or ``deliverd.screen(text,
+detectors=[...])`` in the ``deliverd`` SDK. This package depends on none of
+them: you install the model or the analyzer and pass it in.
+
+Run the model where the text already is. A detector that sends the text to a
+hosted service has sent it somewhere, which is what this check exists to
+prevent.
+"""
+
+from __future__ import annotations
+
+import re
+from typing import Any, Callable, Dict, List, Optional, Sequence
+
+from .data_screen import DATA_KINDS, DetectedSpan
+
+LabelMap = Callable[[str], Optional[str]]
+
+
+def default_labels(label: str) -> Optional[str]:
+    """What the common label sets mean; None to ignore a label."""
+    l = label.lower()
+    if re.fullmatch(r"per|person|private_person|name|full_?name|first_?name|last_?name|given_?name|surname|username", l):
+        return "person_name"
+    if "email" in l:
+        return "email"
+    if "phone" in l or "telephone" in l:
+        return "phone"
+    if "iban" in l:
+        return "iban"
+    if re.search(r"credit_?card|card_?number", l):
+        return "payment_card"
+    if re.fullmatch(r"ip(_?address)?", l):
+        return "ip_address"
+    return None
+
+
+def _field(t: Any, name: str) -> Any:
+    return t.get(name) if isinstance(t, dict) else getattr(t, name, None)
+
+
+def token_classifier(
+    classify: Callable[[str], Sequence[Any]],
+    min_score: float = 0.5,
+    labels: LabelMap = default_labels,
+) -> Callable[[str], List[DetectedSpan]]:
+    """A Hugging Face token-classification pipeline as a detector.
+
+        from transformers import pipeline
+        ner = pipeline("token-classification", model="dslim/bert-base-NER", aggregation_strategy="simple")
+        names = token_classifier(ner)
+
+    Works with anything returning the same dicts (``entity_group`` or
+    ``entity``, ``score``, ``start``, ``end``, ``word``), such as Perplexity's
+    PII-Tracer or a GLiNER model. Check the model's licence before you ship it.
+    Adjacent tokens of one kind become one span.
+    """
+
+    def detect(text: str) -> List[DetectedSpan]:
+        spans: List[DetectedSpan] = []
+        cursor = 0
+        for t in classify(text):
+            raw = _field(t, "entity_group") or _field(t, "entity") or _field(t, "label")
+            score = _field(t, "score")
+            if not raw or (score is not None and score < min_score):
+                continue
+            kind = labels(re.sub(r"^[BIESL]-", "", str(raw)))
+            start, end = _field(t, "start"), _field(t, "end")
+            if not isinstance(start, int) or not isinstance(end, int) or end <= start:
+                word = re.sub(r"^(##|▁|Ġ)", "", str(_field(t, "word") or "")).strip()
+                if not word:
+                    continue
+                start = text.find(word, cursor)
+                if start < 0:
+                    continue
+                end = start + len(word)
+            cursor = end
+            if not kind or kind not in DATA_KINDS:
+                continue
+            last = spans[-1] if spans else None
+            if last and last.kind == kind and re.fullmatch(r"[\s-]?", text[last.end : start]):
+                last.end = end
+            else:
+                spans.append(DetectedSpan(kind=kind, start=start, end=end))
+        return spans
+
+    return detect
+
+
+_PRESIDIO: Dict[str, str] = {
+    "PERSON": "person_name",
+    "EMAIL_ADDRESS": "email",
+    "PHONE_NUMBER": "phone",
+    "IBAN_CODE": "iban",
+    "CREDIT_CARD": "payment_card",
+    "IP_ADDRESS": "ip_address",
+    "US_SSN": "us_ssn",
+    "UK_NINO": "uk_national_insurance",
+}
+
+
+def presidio(analyzer: Any, language: str = "en", min_score: float = 0.5) -> Callable[[str], List[DetectedSpan]]:
+    """A Presidio ``AnalyzerEngine`` as a detector, in process.
+
+        from presidio_analyzer import AnalyzerEngine
+        names = presidio(AnalyzerEngine())
+    """
+
+    def detect(text: str) -> List[DetectedSpan]:
+        results = analyzer.analyze(text=text, language=language, entities=list(_PRESIDIO))
+        return [
+            DetectedSpan(kind=_PRESIDIO[r.entity_type], start=r.start, end=r.end)
+            for r in results
+            if r.entity_type in _PRESIDIO and r.score >= min_score
+        ]
+
+    return detect

deliverd_screen-0.1.0/src/deliverd_screen/cli.py

@@ -0,0 +1,67 @@
+"""deliverd-screen: the check from a terminal, a pre-commit hook or CI.
+
+    deliverd-screen notes.txt
+    cat prompt.txt | deliverd-screen --redact
+    deliverd-screen --fail fixtures/*.json
+
+Reads files, or standard input when there are none. Nothing is sent anywhere.
+"""
+
+from __future__ import annotations
+
+import argparse
+import json
+import sys
+from typing import List, Optional, TextIO
+
+from . import __version__, detect
+from .data_screen import describe_counts, redact
+
+
+def main(argv: Optional[List[str]] = None, stdin: TextIO = sys.stdin, stdout: TextIO = sys.stdout, stderr: TextIO = sys.stderr) -> int:
+    parser = argparse.ArgumentParser(
+        prog="deliverd-screen",
+        description="Find personal data, secrets and confidential terms in text before it goes to an AI model. Runs locally; nothing is sent anywhere.",
+    )
+    parser.add_argument("files", nargs="*", help="files to check; standard input when none")
+    parser.add_argument("--redact", action="store_true", help="print the text with what was found replaced by placeholders (one input)")
+    parser.add_argument("--json", action="store_true", help="print what was found as JSON: kinds, offsets and counts, never values")
+    parser.add_argument("--fail", action="store_true", help="exit 1 when anything is found")
+    parser.add_argument("--terms", metavar="FILE", help="your own words not to send, one per line")
+    parser.add_argument("-v", "--version", action="version", version=__version__)
+    args = parser.parse_args(argv)
+    if args.redact and len(args.files) > 1:
+        stderr.write("--redact takes one input.\n")
+        return 2
+
+    terms: List[str] = []
+    if args.terms:
+        with open(args.terms, encoding="utf-8") as f:
+            terms = [t.strip() for t in f if t.strip() and not t.strip().startswith("#")]
+
+    if not args.files or args.files == ["-"]:
+        inputs = [("stdin", stdin.read())]
+    else:
+        inputs = []
+        for name in args.files:
+            with open(name, encoding="utf-8") as f:
+                inputs.append((name, f.read()))
+
+    found = 0
+    report = []
+    for name, text in inputs:
+        findings, counts = detect(text, terms)
+        found += len(findings)
+        if args.redact:
+            stdout.write(redact(text, findings).text)
+        if args.json:
+            report.append(
+                {"file": name, "counts": counts, "findings": [{"kind": f.kind, "label": f.label, "start": f.start, "end": f.end} for f in findings]}
+            )
+        elif findings:
+            stderr.write("{}: {}\n".format(name, describe_counts(counts)))
+    if args.json:
+        stdout.write(json.dumps(report[0] if len(report) == 1 else report, indent=2) + "\n")
+    elif found == 0 and not args.redact:
+        stderr.write("Nothing found.\n")
+    return 1 if args.fail and found else 0

deliverd_screen-0.1.0/src/deliverd_screen/data_screen.py

@@ -0,0 +1,526 @@
+"""Screening what an agent is about to send to an AI model.
+
+The Python half of ``packages/core/src/data-screen.ts``, rule for rule. Before
+a prompt, a document or a retrieved record goes to a model, this finds the
+personal data, secrets and confidential terms in it, and decides — against what
+the organisation's AI register approves that model to receive — whether it may
+go as it is, go with the findings replaced by placeholders, go only once a
+person agrees, or not go.
+
+**The text need not leave the caller.** Everything here is pure, so
+:meth:`deliverd.Deliverd.screen` runs it where the agent runs and sends
+Deliverd only counts. ``packages/conformance/screening.json`` holds this file
+and the TypeScript one to the same findings, redactions and verdicts.
+
+**A net, not a guarantee.** Structured identifiers are found well and names
+hardly at all; pseudonymised text is still personal data in law. Never tell
+anyone a text is clean because this allowed it.
+"""
+
+from __future__ import annotations
+
+import re
+from dataclasses import dataclass, field
+from typing import Dict, List, Mapping, Optional, Sequence
+
+#: Ordered: the stricter of two classifications is the later one.
+SCREEN_CLASSIFICATIONS = ("public", "internal", "confidential", "restricted")
+SCREEN_CATEGORIES = ("personal", "financial", "special", "secret", "confidential")
+#: ``allow`` | ``redact`` | ``ask`` | ``deny``
+SCREEN_VERDICTS = ("allow", "redact", "ask", "deny")
+
+#: kind → (label, category, placeholder word, whether redacting it removes the concern)
+DATA_KINDS: Dict[str, Dict[str, object]] = {
+    "email": {"label": "Email address", "category": "personal", "placeholder": "EMAIL", "redactable": True},
+    "phone": {"label": "Phone number", "category": "personal", "placeholder": "PHONE", "redactable": True},
+    "iban": {"label": "IBAN", "category": "financial", "placeholder": "IBAN", "redactable": True},
+    "payment_card": {"label": "Payment card number", "category": "financial", "placeholder": "CARD", "redactable": True},
+    "uk_national_insurance": {"label": "UK National Insurance number", "category": "personal", "placeholder": "NINO", "redactable": True},
+    "ie_pps": {"label": "Irish PPS number", "category": "personal", "placeholder": "PPS", "redactable": True},
+    "us_ssn": {"label": "US Social Security number", "category": "personal", "placeholder": "SSN", "redactable": True},
+    "ip_address": {"label": "IP address", "category": "personal", "placeholder": "IP", "redactable": True},
+    "date_of_birth": {"label": "Date of birth", "category": "personal", "placeholder": "DOB", "redactable": True},
+    # Never found by a pattern here: only by a model detector the caller plugs in (``spans``).
+    "person_name": {"label": "Person's name", "category": "personal", "placeholder": "NAME", "redactable": True},
+    "special_category": {"label": "Special-category data", "category": "special", "placeholder": "SPECIAL", "redactable": False},
+    "secret": {"label": "Secret or credential", "category": "secret", "placeholder": "SECRET", "redactable": True},
+    "term": {"label": "Confidential term", "category": "confidential", "placeholder": "TERM", "redactable": True},
+}
+DATA_KIND_KEYS = tuple(DATA_KINDS)
+
+_CATEGORY_CLASSIFICATION = {
+    "personal": "confidential",
+    "financial": "confidential",
+    "confidential": "confidential",
+    "special": "restricted",
+    "secret": "restricted",
+}
+_PERSONAL_CATEGORIES = {"personal", "financial", "special"}
+
+#: Terms past this are ignored, so a pasted list cannot make every screen slow.
+MAX_SCREEN_TERMS = 500
+
+
+@dataclass
+class ScreenTerm:
+    """A word or phrase not to send: a client, a code name. Whole-word, any case."""
+
+    term: str
+    #: Shown to people and used in the placeholder: ``[CLIENT_1]``.
+    label: Optional[str] = None
+    #: ``confidential`` (default) or ``restricted``.
+    classification: Optional[str] = None
+
+
+@dataclass
+class DetectedSpan:
+    """What another detector found, as offsets into the same text."""
+
+    kind: str
+    start: int
+    end: int
+
+
+@dataclass
+class ScreenFinding:
+    """Where one finding is in the screened text. The value is never copied."""
+
+    kind: str
+    category: str
+    classification: str
+    start: int
+    end: int
+    label: str
+    redactable: bool
+
+
+# ── Detectors ──────────────────────────────────────────────────────────────
+
+
+def _digits(s: str) -> str:
+    return re.sub(r"\D", "", s)
+
+
+def _luhn(digits: str) -> bool:
+    total = 0
+    double = False
+    for ch in reversed(digits):
+        d = ord(ch) - 48
+        if double:
+            d *= 2
+            if d > 9:
+                d -= 9
+        total += d
+        double = not double
+    return total % 10 == 0
+
+
+def _iban_valid(raw: str) -> bool:
+    iban = re.sub(r"\s", "", raw).upper()
+    if len(iban) < 15 or len(iban) > 34:
+        return False
+    moved = iban[4:] + iban[:4]
+    remainder = 0
+    for ch in moved:
+        value = str(ord(ch) - 55) if "A" <= ch <= "Z" else ch
+        for digit in value:
+            remainder = (remainder * 10 + (ord(digit) - 48)) % 97
+    return remainder == 1
+
+
+def _pps_valid(raw: str) -> bool:
+    m = re.fullmatch(r"(\d{7})([A-W])([A-IW]?)", raw.upper())
+    if not m:
+        return False
+    total = sum((ord(m.group(1)[i]) - 48) * (8 - i) for i in range(7))
+    if m.group(3):
+        total += (0 if m.group(3) == "W" else ord(m.group(3)) - 64) * 9
+    r = total % 23
+    return m.group(2) == ("W" if r == 0 else chr(64 + r))
+
+
+def _ipv4_valid(raw: str) -> bool:
+    parts = [int(p) for p in raw.split(".")]
+    if len(parts) != 4 or any(p > 255 for p in parts):
+        return False
+    # Loopback and the unspecified address identify nobody.
+    return parts[0] != 127 and parts[0] != 0
+
+
+def _card_valid(m: str) -> bool:
+    d = _digits(m)
+    return 13 <= len(d) <= 19 and _luhn(d)
+
+
+def _phone_valid(m: str) -> bool:
+    return 9 <= len(_digits(m)) <= 15
+
+
+_A = re.ASCII
+_AI = re.ASCII | re.IGNORECASE
+
+#: The same credential patterns the publish scanner blocks a report for.
+_SECRET_PATTERNS = [
+    re.compile(r"\b(?:AKIA|ASIA)[0-9A-Z]{16}\b", _A),
+    re.compile(r"-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP )?PRIVATE KEY(?: BLOCK)?-----", _A),
+    re.compile(r"\bgh[pousr]_[A-Za-z0-9]{36,255}\b", _A),
+    re.compile(r"\bxox[baprs]-[A-Za-z0-9-]{10,}\b", _A),
+    re.compile(r"\b[sr]k_(?:live|test)_[A-Za-z0-9]{20,}\b", _A),
+    re.compile(r"\bsk-ant-[A-Za-z0-9_-]{24,}\b", _A),
+    re.compile(r"\bsk-(?:proj-)?[A-Za-z0-9_-]{32,}\b", _A),
+    re.compile(r"\bAIza[0-9A-Za-z_-]{35}\b", _A),
+    re.compile(r"\beyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b", _A),
+    re.compile(r"""\b(?:password|passwd|secret_key|api_key|apikey|auth_token)\s*[:=]\s*["'][^"']{8,}["']""", _AI),
+    re.compile(r"\b(?:dlv|dlvk)_[A-Za-z0-9]{24,}\b", _A),
+]
+
+_SPECIAL_PATTERN = re.compile(
+    r"\b(?:diagnos(?:is|ed|es)|medical (?:record|history|condition)s?|mental health|prescri(?:bed|ption)s?|HIV|pregnan(?:t|cy)|disabilit(?:y|ies)|sexual orientation|religious belief|ethnic origin|racial origin|trade union member(?:ship)?|biometric|genetic data|criminal (?:record|conviction|offence)s?)\b",
+    _AI,
+)
+
+# (kind, pattern, validator, group)
+_DETECTORS = [
+    *[("secret", p, None, 0) for p in _SECRET_PATTERNS],
+    ("iban", re.compile(r"\b[A-Z]{2}\d{2}(?: ?[A-Z0-9]{4}){2,7}(?: ?[A-Z0-9]{1,4})?\b", _A), _iban_valid, 0),
+    ("payment_card", re.compile(r"\b[2-6]\d{3}(?:[ -]?\d{4}){2}[ -]?\d{1,7}\b", _A), _card_valid, 0),
+    ("us_ssn", re.compile(r"\b(?!000|666|9\d\d)\d{3}-(?!00)\d{2}-(?!0000)\d{4}\b", _A), None, 0),
+    (
+        "uk_national_insurance",
+        re.compile(r"\b(?!BG|GB|NK|KN|TN|NT|ZZ)[A-CEGHJ-PR-TW-Z][A-CEGHJ-NPR-TW-Z] ?\d{2} ?\d{2} ?\d{2} ?[A-D]\b", _A),
+        None,
+        0,
+    ),
+    ("ie_pps", re.compile(r"\b\d{7}[A-W][A-IW]?\b", _A), _pps_valid, 0),
+    ("email", re.compile(r"\b[A-Za-z0-9._%+-]+@[A-Za-z0-9-]+(?:\.[A-Za-z0-9-]+)*\.[A-Za-z]{2,}\b", _A), None, 0),
+    (
+        "date_of_birth",
+        re.compile(
+            r"\b(?:date of birth|d\.?o\.?b\.?|born(?: on)?)\s*[:\-]?\s*(\d{1,2}[/.\-]\d{1,2}[/.\-]\d{2,4}|\d{4}-\d{2}-\d{2}|\d{1,2} (?:jan|feb|mar|apr|may|jun|jul|aug|sep|oct|nov|dec)[a-z]* \d{4})",
+            _AI,
+        ),
+        None,
+        1,
+    ),
+    (
+        "phone",
+        re.compile(r"(?<![\w+])(?:\+\d{1,3}[ .-]?(?:\(0\)[ .-]?)?|\(?0)\d{1,4}\)?(?:[ .-]?\d{2,4}){2,4}(?!\w)", _A),
+        _phone_valid,
+        0,
+    ),
+    ("ip_address", re.compile(r"\b(?:\d{1,3}\.){3}\d{1,3}\b", _A), _ipv4_valid, 0),
+    ("special_category", _SPECIAL_PATTERN, None, 0),
+]
+
+#: Earlier wins an overlap: a card number is not also a phone number.
+_PRIORITY = {
+    k: i
+    for i, k in enumerate(
+        [
+            "secret",
+            "iban",
+            "payment_card",
+            "us_ssn",
+            "uk_national_insurance",
+            "ie_pps",
+            "email",
+            "date_of_birth",
+            "phone",
+            "ip_address",
+            "term",
+            "person_name",
+            "special_category",
+        ]
+    )
+}
+
+
+def _term_of(t: object) -> ScreenTerm:
+    if isinstance(t, ScreenTerm):
+        return t
+    if isinstance(t, Mapping):
+        return ScreenTerm(term=str(t.get("term", "")), label=t.get("label"), classification=t.get("classification"))
+    return ScreenTerm(term=str(t))
+
+
+def _span_of(s: object) -> Optional[DetectedSpan]:
+    if isinstance(s, DetectedSpan):
+        return s
+    if isinstance(s, Mapping):
+        try:
+            return DetectedSpan(kind=str(s.get("kind", "")), start=s["start"], end=s["end"])
+        except KeyError:
+            return None
+    return None
+
+
+def screen_text(text: str, terms: Sequence[object] = (), spans: Sequence[object] = ()) -> List[ScreenFinding]:
+    """Find what is in a text. Each character belongs to at most one finding.
+
+    ``terms`` are :class:`ScreenTerm`, dicts with the same keys, or strings.
+    ``spans`` are another detector's findings — a named-entity model, a DLP
+    service — as :class:`DetectedSpan` or dicts of ``kind``, ``start`` and
+    ``end``, held to the same rules; one outside the text or of no known kind
+    is dropped.
+    """
+    raw: List[ScreenFinding] = []
+
+    def add(kind: str, start: int, end: int, label: Optional[str] = None, classification: Optional[str] = None) -> None:
+        spec = DATA_KINDS[kind]
+        raw.append(
+            ScreenFinding(
+                kind=kind,
+                category=str(spec["category"]),
+                classification=classification or _CATEGORY_CLASSIFICATION[str(spec["category"])],
+                start=start,
+                end=end,
+                label=label or str(spec["label"]),
+                redactable=bool(spec["redactable"]),
+            )
+        )
+
+    for kind, pattern, valid, group in _DETECTORS:
+        for m in pattern.finditer(text):
+            value = m.group(group) if group else m.group(0)
+            if not value or (valid is not None and not valid(value)):
+                continue
+            start = m.start() + m.group(0).rfind(value) if group else m.start()
+            add(kind, start, start + len(value))
+
+    for t in [_term_of(t) for t in list(terms)[:MAX_SCREEN_TERMS]]:
+        term = t.term.strip()
+        if len(term) < 2:
+            continue
+        pattern = re.compile(r"(?<![^\W_])" + re.escape(term) + r"(?![^\W_])", re.IGNORECASE)
+        for m in pattern.finditer(text):
+            add("term", m.start(), m.end(), (t.label or "").strip() or None, t.classification or "confidential")
+
+    for sp in (_span_of(s) for s in spans):
+        if sp is None or sp.kind not in DATA_KINDS or sp.kind == "term":
+            continue
+        if not isinstance(sp.start, int) or not isinstance(sp.end, int) or isinstance(sp.start, bool) or isinstance(sp.end, bool):
+            continue
+        if sp.start < 0 or sp.end > len(text) or sp.end <= sp.start:
+            continue
+        add(sp.kind, sp.start, sp.end)
+
+    raw.sort(key=lambda f: (_PRIORITY[f.kind], -(f.end - f.start), f.start))
+    kept: List[ScreenFinding] = []
+    for f in raw:
+        if any(f.start < k.end and k.start < f.end for k in kept):
+            continue
+        kept.append(f)
+    return sorted(kept, key=lambda f: f.start)
+
+
+def summarise(findings: Sequence[ScreenFinding]) -> Dict[str, int]:
+    """Counts only: what goes over the wire when the text stays where it is."""
+    counts: Dict[str, int] = {}
+    for f in findings:
+        counts[f.kind] = counts.get(f.kind, 0) + 1
+    return counts
+
+
+# ── Redaction ──────────────────────────────────────────────────────────────
+
+
+@dataclass
+class Redaction:
+    text: str
+    #: Placeholder → original value. Stays with the caller; never sent anywhere.
+    replacements: Dict[str, str] = field(default_factory=dict)
+
+
+def _placeholder_word(f: ScreenFinding) -> str:
+    if f.kind == "term" and f.label != DATA_KINDS["term"]["label"]:
+        word = re.sub(r"^_|_$", "", re.sub(r"[^A-Z0-9]+", "_", f.label.upper()))[:24]
+        return word or "TERM"
+    return str(DATA_KINDS[f.kind]["placeholder"])
+
+
+def redact(text: str, findings: Sequence[ScreenFinding]) -> Redaction:
+    """Replace each redactable finding with a placeholder, one per distinct value."""
+    replacements: Dict[str, str] = {}
+    by_value: Dict[str, str] = {}
+    counters: Dict[str, int] = {}
+    out = []
+    at = 0
+    for f in sorted(findings, key=lambda f: f.start):
+        if not f.redactable or f.start < at:
+            continue
+        value = text[f.start : f.end]
+        key = "{}\0{}".format(f.kind, value.lower())
+        placeholder = by_value.get(key)
+        if placeholder is None:
+            word = _placeholder_word(f)
+            counters[word] = counters.get(word, 0) + 1
+            placeholder = "[{}_{}]".format(word, counters[word])
+            by_value[key] = placeholder
+            replacements[placeholder] = value
+        out.append(text[at : f.start] + placeholder)
+        at = f.end
+    out.append(text[at:])
+    return Redaction(text="".join(out), replacements=replacements)
+
+
+def restore(text: str, replacements: Mapping[str, str]) -> str:
+    """Put the original values back into text a model wrote using the placeholders."""
+    keys = sorted(replacements, key=len, reverse=True)
+    if not keys:
+        return text
+    pattern = re.compile("|".join(re.escape(k) for k in keys))
+    return pattern.sub(lambda m: replacements.get(m.group(0), m.group(0)), text)
+
+
+# ── Deciding ───────────────────────────────────────────────────────────────
+
+
+@dataclass
+class ScreenTarget:
+    """What the destination model is approved to receive: its AI register record."""
+
+    name: str
+    approved_classification: Optional[str]
+    personal_data: bool
+    active: bool = True
+
+
+@dataclass
+class ScreenAssessment:
+    verdict: str
+    classification: str
+    personal_data: bool
+    categories: List[str]
+    offending: List[str]
+    reasons: List[str]
+
+
+DEFAULT_SCREEN_POLICY: Dict[str, object] = {
+    "secrets": "deny",
+    "beyondApproval": "redact",
+    "notRedactable": "ask",
+    "unregistered": {"approvedClassification": "internal", "personalData": False},
+}
+
+_VERDICT_RANK = {"allow": 0, "redact": 1, "ask": 2, "deny": 3}
+
+
+def _stricter(a: str, b: str) -> str:
+    return b if _VERDICT_RANK[b] > _VERDICT_RANK[a] else a
+
+
+def _rank(c: str) -> int:
+    return SCREEN_CLASSIFICATIONS.index(c)
+
+
+def describe_counts(counts: Mapping[str, int]) -> str:
+    """``2 email addresses and 1 IBAN``."""
+    parts = []
+    for k in DATA_KIND_KEYS:
+        n = counts.get(k) or 0
+        if n <= 0:
+            continue
+        label = str(DATA_KINDS[k]["label"])
+        s = "" if n == 1 else "s"
+        if k == "email":
+            parts.append("{} email address{}".format(n, "" if n == 1 else "es"))
+        elif k == "special_category":
+            parts.append("{} mention{} of special-category data".format(n, s))
+        elif k == "secret":
+            parts.append("{} secret{} or credential{}".format(n, s, s))
+        elif k == "term":
+            parts.append("{} confidential term{}".format(n, s))
+        elif k == "person_name":
+            parts.append("{} {}".format(n, "person's name" if n == 1 else "people's names"))
+        elif re.match(r"^[A-Z]{2,}", label):
+            parts.append("{} {}{}".format(n, label, s))
+        else:
+            parts.append("{} {}{}".format(n, label.lower(), s))
+    if len(parts) <= 1:
+        return parts[0] if parts else "nothing"
+    return "{} and {}".format(", ".join(parts[:-1]), parts[-1])
+
+
+def assess_counts(
+    counts: Mapping[str, int],
+    target: Optional[ScreenTarget],
+    policy: Optional[Mapping[str, object]] = None,
+    term_classification: str = "confidential",
+) -> ScreenAssessment:
+    """Decide from counts alone, the same way the server does."""
+    p = dict(DEFAULT_SCREEN_POLICY)
+    p.update(policy or {})
+    present = [k for k in DATA_KIND_KEYS if (counts.get(k) or 0) > 0]
+    categories = [c for c in SCREEN_CATEGORIES if any(DATA_KINDS[k]["category"] == c for k in present)]
+
+    def class_of(k: str) -> str:
+        return term_classification if k == "term" else _CATEGORY_CLASSIFICATION[str(DATA_KINDS[k]["category"])]
+
+    classification = "public"
+    for k in present:
+        if _rank(class_of(k)) > _rank(classification):
+            classification = class_of(k)
+    personal = any(c in _PERSONAL_CATEGORIES for c in categories)
+
+    if target is not None and not target.active:
+        return ScreenAssessment(
+            "deny",
+            classification,
+            personal,
+            categories,
+            present,
+            ["{} is not an active system in the AI register, so nothing should be sent to it.".format(target.name)],
+        )
+    reasons: List[str] = []
+    offending: List[str] = []
+    verdict = "allow"
+    if not present:
+        return ScreenAssessment(verdict, classification, personal, categories, offending, reasons)
+
+    unregistered = p["unregistered"]
+    assert isinstance(unregistered, Mapping)
+    name = target.name if target is not None else "an AI system that is not in the register"
+    approved = (
+        (target.approved_classification or str(unregistered["approvedClassification"]))
+        if target is not None
+        else str(unregistered["approvedClassification"])
+    )
+    personal_approved = target.personal_data if target is not None else bool(unregistered["personalData"])
+
+    secrets = counts.get("secret") or 0
+    if secrets > 0:
+        verdict = _stricter(verdict, str(p["secrets"]))
+        offending.append("secret")
+        reasons.append("It contains {}, which should never be sent to a model.".format(describe_counts({"secret": secrets})))
+
+    for k in present:
+        if k == "secret":
+            continue
+        too_sensitive = _rank(class_of(k)) > _rank(approved)
+        personal_not_approved = DATA_KINDS[k]["category"] != "confidential" and not personal_approved
+        if not too_sensitive and not personal_not_approved:
+            continue
+        action = str(p["beyondApproval"] if DATA_KINDS[k]["redactable"] else p["notRedactable"])
+        verdict = _stricter(verdict, action)
+        offending.append(k)
+        why = (
+            "which is not approved to receive personal data"
+            if personal_not_approved
+            else "which is approved for {} data at most".format(approved)
+        )
+        reasons.append("It contains {}, and goes to {}, {}.".format(describe_counts({k: counts[k]}), name, why))
+
+    return ScreenAssessment(verdict, classification, personal, categories, offending, reasons)
+
+
+def redact_for(text: str, findings: Sequence[ScreenFinding], verdict: str, offending: Sequence[str]) -> Optional[Redaction]:
+    """The text with only the findings behind a verdict replaced. ``None`` for a deny."""
+    if verdict == "deny":
+        return None
+    wanted = set(offending)
+    return redact(text, [f for f in findings if f.kind in wanted])
+
+
+def term_classification_of(findings: Sequence[ScreenFinding]) -> str:
+    """The strictest classification among the terms found."""
+    return "restricted" if any(f.kind == "term" and f.classification == "restricted" for f in findings) else "confidential"