guardtrellis 0.1.0__py3-none-any.whl

guardtrellis/__init__.py

@@ -0,0 +1,31 @@
+"""GuardTrellis: explicit, local boundaries around model and tool calls."""
+
+from .guard import Guard, Scanner
+from .json_check import JSONScanner
+from .models import Action, Check, Edit, Finding, Rejected, Result, RunResult, Stage, Trace
+from .scanners import InvisibleScanner, LiteralScanner, PIIScanner, SecretScanner
+from .tools import ToolGuard, ToolResult
+
+__version__ = "0.1.0"
+
+__all__ = [
+    "Action",
+    "Check",
+    "Edit",
+    "Finding",
+    "Guard",
+    "InvisibleScanner",
+    "JSONScanner",
+    "LiteralScanner",
+    "PIIScanner",
+    "Rejected",
+    "Result",
+    "RunResult",
+    "Scanner",
+    "SecretScanner",
+    "Stage",
+    "ToolGuard",
+    "ToolResult",
+    "Trace",
+    "__version__",
+]

guardtrellis/guard.py

@@ -0,0 +1,276 @@
+"""Ordered checks and provider-independent, complete-response callback integration."""
+
+from __future__ import annotations
+
+import asyncio
+import contextvars
+import inspect
+import math
+import re
+from collections.abc import Awaitable, Callable, Sequence
+from dataclasses import replace
+from functools import partial
+from typing import Protocol, TypeVar, cast
+
+from .models import Action, Check, Finding, Result, RunResult, Stage, Trace, combine_actions
+
+T = TypeVar("T")
+_IDENTIFIER = re.compile(r"[a-zA-Z][a-zA-Z0-9_]{0,63}\Z")
+MAX_FINDINGS = 256
+
+
+class Scanner(Protocol):
+    """Custom scanners are trusted code; never put content in names or finding codes."""
+
+    @property
+    def name(self) -> str: ...
+
+    def scan(self, text: str, *, stage: Stage) -> Check | Awaitable[Check]: ...
+
+
+def _consume_task(task: asyncio.Task[T]) -> None:
+    if not task.cancelled():
+        task.exception()
+
+
+def _discard_worker_result(future: asyncio.Future[T | Awaitable[T]]) -> None:
+    if future.cancelled() or future.exception() is not None:
+        return
+    value = future.result()
+    if inspect.iscoroutine(value):
+        value.close()
+    elif isinstance(value, asyncio.Future):
+        value.cancel()
+
+
+async def _invoke(function: Callable[[], T | Awaitable[T]]) -> T:
+    if inspect.iscoroutinefunction(function):
+        return await cast(Awaitable[T], function())
+    # Copy context like to_thread, but retain the future to dispose of late awaitables.
+    # Cancelling a thread's await cannot stop that thread from returning a coroutine.
+    worker = asyncio.get_running_loop().run_in_executor(
+        None, contextvars.copy_context().run, function
+    )
+    try:
+        value = await asyncio.shield(worker)
+    except asyncio.CancelledError:
+        worker.add_done_callback(_discard_worker_result)
+        raise
+    if inspect.isawaitable(value):
+        return await value
+    return value
+
+
+async def _bounded(function: Callable[[], T | Awaitable[T]], wait_seconds: float) -> T:
+    task = asyncio.create_task(_invoke(function))
+    try:
+        # wait_for/timeout can accept late results if user code suppresses cancellation.
+        done, _ = await asyncio.wait({task}, timeout=wait_seconds)
+        if not done:
+            raise TimeoutError
+        return task.result()
+    finally:
+        if not task.done():
+            task.cancel()
+            task.add_done_callback(_consume_task)
+
+
+def _sync_value(value: T | Awaitable[T]) -> T:
+    if inspect.isawaitable(value):
+        if inspect.iscoroutine(value):
+            value.close()
+        raise TypeError("Use the asynchronous entry point for awaitable work")
+    return value
+
+
+def _error(stage: Stage, code: str) -> Result:
+    return Result(Action.ERROR, stage, None, (Finding(code, scanner="guard"),))
+
+
+class _Pipeline:
+    def __init__(self, text: str, stage: Stage, max_chars: int):
+        self.text = text
+        self.stage = stage
+        self.max_chars = max_chars
+        self.action = Action.ALLOW
+        self.revision = 0
+        self.findings: list[Finding] = []
+        self.trace: list[Trace] = []
+
+    def apply(self, check: Check, name: str, index: int) -> None:
+        # Validate a custom scanner's entire response before changing state.
+        if not isinstance(check, Check) or not isinstance(check.action, Action):
+            raise ValueError("Invalid scanner decision")
+        if len(check.findings) > MAX_FINDINGS or len(check.edits) > MAX_FINDINGS:
+            raise ValueError("Scanner result limit exceeded")
+        if check.action == Action.ALLOW and (check.findings or check.edits):
+            raise ValueError("Allow cannot contain findings or edits")
+        if check.action != Action.ALLOW and not check.findings:
+            raise ValueError("Non-allow decisions require a reason")
+        if bool(check.edits) != (check.action == Action.REDACT):
+            raise ValueError("Only redact decisions may contain edits")
+        for finding in check.findings:
+            if not isinstance(finding, Finding) or not _IDENTIFIER.fullmatch(finding.code):
+                raise ValueError("Invalid finding")
+            if finding.start is None and finding.end is None:
+                continue
+            if (
+                type(finding.start) is not int
+                or type(finding.end) is not int
+                or not 0 <= finding.start < finding.end <= len(self.text)
+            ):
+                raise ValueError("Invalid finding span")
+        previous = 0
+        for edit in sorted(check.edits, key=lambda item: item.start):
+            if (
+                type(edit.start) is not int
+                or type(edit.end) is not int
+                or not previous <= edit.start < edit.end <= len(self.text)
+                or not isinstance(edit.replacement, str)
+            ):
+                raise ValueError("Invalid edit")
+            previous = edit.end
+        updated = self.text
+        for edit in sorted(check.edits, key=lambda item: item.start, reverse=True):
+            updated = updated[: edit.start] + edit.replacement + updated[edit.end :]
+            if len(updated) > self.max_chars:
+                raise ValueError("Transformed text exceeds limit")
+        before = self.revision
+        if check.action == Action.REDACT:
+            self.revision += 1
+        self.findings.extend(
+            replace(item, scanner=name, scanner_index=index, revision=before)
+            for item in check.findings
+        )
+        self.trace.append(Trace(name, index, check.action, before, self.revision))
+        self.text = updated
+        self.action = combine_actions(self.action, check.action)
+
+    def fail(self, name: str, index: int, code: str) -> None:
+        self.apply(Check(Action.ERROR, (Finding(code),)), name, index)
+
+    @property
+    def stopped(self) -> bool:
+        return self.action in (Action.BLOCK, Action.ERROR)
+
+    def result(self) -> Result:
+        return Result(
+            self.action,
+            self.stage,
+            None if self.stopped else self.text,
+            tuple(self.findings),
+            tuple(self.trace),
+        )
+
+
+class Guard:
+    """Explicit, ordered stage policies. An unconfigured stage allows bounded text.
+
+    Async timeout is per scanner/callback, not for the complete run. Cancellation
+    cannot terminate a worker thread or preempt an event-loop-blocking coroutine.
+    Synchronous entry points have no execution deadline.
+    """
+
+    def __init__(
+        self,
+        *,
+        input_scanners: Sequence[Scanner] = (),
+        output_scanners: Sequence[Scanner] = (),
+        retrieval_scanners: Sequence[Scanner] = (),
+        tool_scanners: Sequence[Scanner] = (),
+        max_chars: int = 100_000,
+        timeout_seconds: float = 5.0,
+    ):
+        if type(max_chars) is not int or max_chars < 1:
+            raise ValueError("max_chars must be a positive integer")
+        if not math.isfinite(timeout_seconds) or timeout_seconds <= 0:
+            raise ValueError("timeout_seconds must be positive and finite")
+        self.max_chars = max_chars
+        self.timeout_seconds = timeout_seconds
+        self._scanners = {
+            Stage.INPUT: tuple(input_scanners),
+            Stage.OUTPUT: tuple(output_scanners),
+            Stage.RETRIEVAL: tuple(retrieval_scanners),
+            Stage.TOOL: tuple(tool_scanners),
+        }
+        for scanners in self._scanners.values():
+            for scanner in scanners:
+                if not _IDENTIFIER.fullmatch(scanner.name) or not callable(scanner.scan):
+                    raise ValueError("Scanners require a static identifier name and scan method")
+
+    def _prepare(self, text: str, stage: Stage) -> _Pipeline | Result:
+        if not isinstance(stage, Stage):
+            raise ValueError("stage must be a Stage enum")
+        if not isinstance(text, str):
+            return _error(stage, "invalid_text_type")
+        if len(text) > self.max_chars:
+            return _error(stage, "text_limit_exceeded")
+        return _Pipeline(text, stage, self.max_chars)
+
+    def scan(self, text: str, *, stage: Stage = Stage.INPUT) -> Result:
+        pipeline = self._prepare(text, stage)
+        if isinstance(pipeline, Result):
+            return pipeline
+        for index, scanner in enumerate(self._scanners[stage]):
+            try:
+                check = _sync_value(scanner.scan(pipeline.text, stage=stage))
+                pipeline.apply(check, scanner.name, index)
+            except Exception:
+                pipeline.fail(scanner.name, index, "scanner_error")
+            if pipeline.stopped:
+                break
+        return pipeline.result()
+
+    async def ascan(self, text: str, *, stage: Stage = Stage.INPUT) -> Result:
+        pipeline = self._prepare(text, stage)
+        if isinstance(pipeline, Result):
+            return pipeline
+        for index, scanner in enumerate(self._scanners[stage]):
+            try:
+                check = await _bounded(
+                    partial(scanner.scan, pipeline.text, stage=stage), self.timeout_seconds
+                )
+                pipeline.apply(check, scanner.name, index)
+            except TimeoutError:
+                pipeline.fail(scanner.name, index, "scanner_timeout")
+            except Exception:
+                pipeline.fail(scanner.name, index, "scanner_error")
+            if pipeline.stopped:
+                break
+        return pipeline.result()
+
+    def run(self, text: str, model: Callable[[str], str]) -> RunResult:
+        checked_input = self.scan(text, stage=Stage.INPUT)
+        if not checked_input.accepted:
+            return RunResult(checked_input.action, checked_input, None)
+        try:
+            output = _sync_value(model(checked_input.require_text()))
+        except Exception:
+            checked_output = _error(Stage.OUTPUT, "callback_error")
+        else:
+            checked_output = self.scan(output, stage=Stage.OUTPUT)
+        return RunResult(
+            combine_actions(checked_input.action, checked_output.action),
+            checked_input,
+            checked_output,
+        )
+
+    async def arun(self, text: str, model: Callable[[str], str | Awaitable[str]]) -> RunResult:
+        checked_input = await self.ascan(text, stage=Stage.INPUT)
+        if not checked_input.accepted:
+            return RunResult(checked_input.action, checked_input, None)
+        try:
+            output = await _bounded(
+                lambda: model(checked_input.require_text()), self.timeout_seconds
+            )
+        except TimeoutError:
+            checked_output = _error(Stage.OUTPUT, "callback_timeout")
+        except Exception:
+            checked_output = _error(Stage.OUTPUT, "callback_error")
+        else:
+            checked_output = await self.ascan(output, stage=Stage.OUTPUT)
+        return RunResult(
+            combine_actions(checked_input.action, checked_output.action),
+            checked_input,
+            checked_output,
+        )

guardtrellis/json_check.py

@@ -0,0 +1,170 @@
+"""Strict JSON and local Draft 2020-12 validation with bounded structural depth."""
+
+from __future__ import annotations
+
+import json
+import math
+from typing import Any
+
+from jsonschema import Draft202012Validator
+from jsonschema.exceptions import SchemaError
+from referencing import Registry, Resource
+from referencing.exceptions import Unresolvable
+from referencing.jsonschema import DRAFT202012
+
+from .models import Action, Check, Finding, Stage
+
+Schema = dict[str, Any] | bool
+_DIALECT = "https://json-schema.org/draft/2020-12/schema"
+
+
+class _JSONProblem(ValueError):
+    pass
+
+
+def _constant(_: str) -> Any:
+    raise _JSONProblem("json_non_finite")
+
+
+def _float(value: str) -> float:
+    number = float(value)
+    if not math.isfinite(number):
+        raise _JSONProblem("json_non_finite")
+    return number
+
+
+def _object(pairs: list[tuple[str, Any]]) -> dict[str, Any]:
+    result: dict[str, Any] = {}
+    for key, value in pairs:
+        if key in result:
+            raise _JSONProblem("json_duplicate_key")
+        result[key] = value
+    return result
+
+
+def _check_depth(text: str, limit: int) -> None:
+    depth = 0
+    in_string = False
+    escaped = False
+    for char in text:
+        if in_string:
+            if escaped:
+                escaped = False
+            elif char == "\\":
+                escaped = True
+            elif char == '"':
+                in_string = False
+        elif char == '"':
+            in_string = True
+        elif char in "[{":
+            depth += 1
+            if depth > limit:
+                raise _JSONProblem("json_too_deep")
+        elif char in "]}":
+            depth -= 1
+
+
+def strict_loads(text: str, *, max_depth: int = 32) -> Any:
+    _check_depth(text, max_depth)
+    try:
+        return json.loads(
+            text, object_pairs_hook=_object, parse_constant=_constant, parse_float=_float
+        )
+    except _JSONProblem:
+        raise
+    except (ValueError, RecursionError):
+        raise _JSONProblem("json_invalid") from None
+
+
+def _check_schema_policy(schema: Schema) -> None:
+    """Check schema positions AND referenced extension data, without inspecting const data.
+
+    JSON pointers can turn arbitrary extension fields into active schemas. Following
+    them prevents hiding a regex/remote reference outside normal schema positions.
+    """
+    root = DRAFT202012.create_resource(schema)
+    registry = Registry().with_resource("urn:guardtrellis:root", root)
+    resolver = registry.resolver("urn:guardtrellis:root").in_subresource(root)
+    pending: list[tuple[Resource[Any], Any]] = [(root, resolver)]
+    visited: set[int] = set()
+    while pending:
+        resource, current_resolver = pending.pop()
+        node = resource.contents
+        if id(node) in visited or isinstance(node, bool):
+            continue
+        visited.add(id(node))
+        Draft202012Validator.check_schema(node)
+        if node.get("$schema", _DIALECT).rstrip("#") != _DIALECT:
+            raise ValueError
+        if "pattern" in node or "patternProperties" in node:
+            raise ValueError
+        for keyword in ("$ref", "$dynamicRef"):
+            if keyword not in node:
+                continue
+            if not node[keyword].startswith("#"):
+                raise ValueError
+            try:
+                resolved = current_resolver.lookup(node[keyword])
+            except Unresolvable:
+                # A missing target is an explicit runtime ERROR if the branch is used.
+                continue
+            pending.append((DRAFT202012.create_resource(resolved.contents), resolved.resolver))
+        for child in resource.subresources():
+            pending.append((child, current_resolver.in_subresource(child)))
+
+
+class JSONScanner:
+    """Validate JSON and an optional, trusted Draft 2020-12 schema.
+
+    References must be document-local fragments. Regex schema keywords are
+    rejected to avoid exposing Python's backtracking regex engine to instances.
+    Formats remain annotations, per JSON Schema's default behavior.
+    """
+
+    name = "json"
+
+    def __init__(
+        self,
+        schema: Schema | None = None,
+        *,
+        max_depth: int = 32,
+        require_object: bool = False,
+    ):
+        if type(max_depth) is not int or not 1 <= max_depth <= 64:
+            raise ValueError("max_depth must be an integer from 1 to 64")
+        self.max_depth = max_depth
+        self.require_object = require_object
+        self._validator: Draft202012Validator | None = None
+        if schema is not None:
+            try:
+                # Snapshot config so mutation of the caller's schema cannot change a policy.
+                if not isinstance(schema, (dict, bool)):
+                    raise ValueError
+                serialized = json.dumps(schema, allow_nan=False)
+                if len(serialized) > 100_000:
+                    raise ValueError
+                copied = strict_loads(serialized, max_depth=64)
+                Draft202012Validator.check_schema(copied)
+                _check_schema_policy(copied)
+                # Supplying a Registry explicitly prevents legacy automatic URL retrieval.
+                self._validator = Draft202012Validator(copied, registry=Registry())
+            except (ValueError, TypeError, RecursionError, SchemaError):
+                raise ValueError(
+                    "Schema must be bounded Draft 2020-12 with local references "
+                    "and no regex keywords"
+                ) from None
+
+    def scan(self, text: str, *, stage: Stage) -> Check:
+        try:
+            instance = strict_loads(text, max_depth=self.max_depth)
+        except _JSONProblem as problem:
+            return Check(Action.BLOCK, (Finding(str(problem)),))
+        if self.require_object and not isinstance(instance, dict):
+            return Check(Action.BLOCK, (Finding("json_object_required"),))
+        if self._validator is not None:
+            # Consume one error only; do not retain ValidationError (it holds the instance).
+            # Resolution/runtime errors propagate into Guard's explicit ERROR result.
+            error = next(self._validator.iter_errors(instance), None)
+            if error is not None:
+                return Check(Action.BLOCK, (Finding("json_schema_mismatch"),))
+        return Check()

guardtrellis/models.py

@@ -0,0 +1,149 @@
+"""Public, payload-safe result types. Explicit serialization may still expose text."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+from enum import StrEnum
+from typing import Any
+
+
+class Action(StrEnum):
+    ALLOW = "allow"
+    WARN = "warn"
+    REDACT = "redact"
+    BLOCK = "block"
+    ERROR = "error"
+
+
+class Stage(StrEnum):
+    INPUT = "input"
+    OUTPUT = "output"
+    RETRIEVAL = "retrieval"
+    TOOL = "tool"
+
+
+@dataclass(frozen=True)
+class Finding:
+    """Offsets are half-open Python character indices in the indicated text revision.
+
+    Codes and scanner names must be static metadata, never matched text.
+    The orchestrator supplies revision, scanner, and scanner_index.
+    """
+
+    code: str
+    start: int | None = None
+    end: int | None = None
+    scanner: str = ""
+    scanner_index: int = -1
+    revision: int = 0
+
+
+@dataclass(frozen=True)
+class Edit:
+    """A replacement in the current scanner's input, never a rehydration map."""
+
+    start: int
+    end: int
+    replacement: str = field(default="[REDACTED]", repr=False)
+
+
+@dataclass(frozen=True)
+class Check:
+    """A scanner decision; REDACT requires non-overlapping edits and findings."""
+
+    action: Action = Action.ALLOW
+    findings: tuple[Finding, ...] = ()
+    edits: tuple[Edit, ...] = field(default=(), repr=False)
+
+
+@dataclass(frozen=True)
+class Trace:
+    scanner: str
+    scanner_index: int
+    action: Action
+    revision_before: int
+    revision_after: int
+
+
+class Rejected(RuntimeError):
+    """Raised by require_text when a result has no deliverable content."""
+
+
+@dataclass(frozen=True)
+class Result:
+    action: Action
+    stage: Stage
+    text: str | None = field(repr=False)
+    findings: tuple[Finding, ...] = ()
+    trace: tuple[Trace, ...] = ()
+
+    @property
+    def accepted(self) -> bool:
+        return self.action in (Action.ALLOW, Action.WARN, Action.REDACT)
+
+    def require_text(self) -> str:
+        if not self.accepted or self.text is None:
+            raise Rejected(f"GuardTrellis rejected content: {self.action.value}")
+        return self.text
+
+    def diagnostics(self) -> dict[str, Any]:
+        """The supported metadata-only logging interface (unlike dataclasses.asdict)."""
+        return {
+            "action": self.action.value,
+            "stage": self.stage.value,
+            "findings": [
+                {
+                    "code": item.code,
+                    "start": item.start,
+                    "end": item.end,
+                    "scanner": item.scanner,
+                    "scanner_index": item.scanner_index,
+                    "revision": item.revision,
+                }
+                for item in self.findings
+            ],
+            "trace": [
+                {
+                    "scanner": item.scanner,
+                    "scanner_index": item.scanner_index,
+                    "action": item.action.value,
+                    "revision_before": item.revision_before,
+                    "revision_after": item.revision_after,
+                }
+                for item in self.trace
+            ],
+        }
+
+
+@dataclass(frozen=True)
+class RunResult:
+    action: Action
+    input_result: Result
+    output_result: Result | None
+
+    @property
+    def text(self) -> str | None:
+        if self.output_result is None:
+            return None
+        return self.output_result.text
+
+    @property
+    def accepted(self) -> bool:
+        return self.output_result is not None and self.output_result.accepted
+
+    def require_text(self) -> str:
+        if not self.accepted or self.text is None:
+            raise Rejected(f"GuardTrellis rejected call: {self.action.value}")
+        return self.text
+
+    def diagnostics(self) -> dict[str, Any]:
+        return {
+            "action": self.action.value,
+            "input": self.input_result.diagnostics(),
+            "output": self.output_result.diagnostics() if self.output_result else None,
+        }
+
+
+def combine_actions(*actions: Action) -> Action:
+    priority = (Action.ALLOW, Action.WARN, Action.REDACT, Action.BLOCK, Action.ERROR)
+    return max(actions, key=priority.index)

guardtrellis/scanners.py

@@ -0,0 +1,162 @@
+"""Small, deterministic format detectors. These are not semantic safety classifiers."""
+
+from __future__ import annotations
+
+import re
+import unicodedata
+from collections.abc import Iterable, Sequence
+
+from .guard import MAX_FINDINGS
+from .models import Action, Check, Edit, Finding, Stage
+
+
+def _validate_action(action: Action) -> None:
+    if not isinstance(action, Action) or action not in (Action.WARN, Action.REDACT, Action.BLOCK):
+        raise ValueError("Detector action must be WARN, REDACT, or BLOCK")
+
+
+def _decision(findings: Iterable[Finding], action: Action, replacement: str) -> Check:
+    collected = []
+    for finding in findings:
+        collected.append(finding)
+        if len(collected) > MAX_FINDINGS:
+            return Check(Action.ERROR, (Finding("finding_limit_exceeded"),))
+    if not collected:
+        return Check()
+    ordered = tuple(sorted(collected, key=lambda item: (item.start or 0, item.end or 0, item.code)))
+    edits: list[Edit] = []
+    if action == Action.REDACT:
+        for item in ordered:
+            assert item.start is not None and item.end is not None
+            if edits and item.start < edits[-1].end:
+                previous = edits.pop()
+                edits.append(Edit(previous.start, max(previous.end, item.end), replacement))
+            else:
+                edits.append(Edit(item.start, item.end, replacement))
+    return Check(action, ordered, tuple(edits))
+
+
+class PIIScanner:
+    """ASCII email, contiguous international +phone (8-15 digits), US SSN shapes.
+
+    This does not identify people, validate issuance, or cover all PII formats.
+    """
+
+    name = "pii"
+    _patterns = {
+        "email": re.compile(
+            r"(?<![\w.!#$%&'*+/=?^`{|}~@-])"
+            r"[A-Za-z0-9!#$%&'*+/=?^_`{|}~-]"
+            r"[A-Za-z0-9.!#$%&'*+/=?^_`{|}~-]{0,63}"
+            r"@(?:[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?\.){1,8}"
+            r"[A-Za-z]{2,63}(?![\w@-])"
+        ),
+        "phone": re.compile(r"(?<![\w+])\+[1-9][0-9]{7,14}(?!\w)"),
+        "ssn": re.compile(
+            r"(?<!\w)(?!000|666|9[0-9]{2})[0-9]{3}-(?!00)[0-9]{2}-(?!0000)[0-9]{4}(?!\w)"
+        ),
+    }
+
+    def __init__(
+        self,
+        *,
+        formats: Sequence[str] = ("email", "phone", "ssn"),
+        action: Action = Action.REDACT,
+    ):
+        _validate_action(action)
+        if not formats or any(name not in self._patterns for name in formats):
+            raise ValueError("Unsupported or empty PII format selection")
+        self._formats = tuple(dict.fromkeys(formats))
+        self.action = action
+
+    def scan(self, text: str, *, stage: Stage) -> Check:
+        findings = (
+            Finding(f"pii_{name}", match.start(), match.end())
+            for name in self._formats
+            for match in self._patterns[name].finditer(text)
+        )
+        return _decision(findings, self.action, "[PII]")
+
+
+class SecretScanner:
+    """Selected token signatures and private-key envelopes, not credential verification."""
+
+    name = "secrets"
+    _patterns = {
+        "github_classic": re.compile(r"(?<!\w)gh[pousr]_[A-Za-z0-9]{36}(?!\w)"),
+        "github_fine_grained": re.compile(r"(?<!\w)github_pat_[A-Za-z0-9_]{82}(?!\w)"),
+        "aws_access_key_id": re.compile(r"(?<!\w)(?:AKIA|ASIA)[A-Z0-9]{16}(?!\w)"),
+    }
+    _pem = re.compile(r"-----BEGIN ((?:RSA |EC |DSA |OPENSSH |ENCRYPTED )?PRIVATE KEY)-----")
+
+    def __init__(self, *, action: Action = Action.BLOCK):
+        _validate_action(action)
+        self.action = action
+
+    def _find(self, text: str) -> Iterable[Finding]:
+        for name, pattern in self._patterns.items():
+            for match in pattern.finditer(text):
+                yield Finding(f"secret_{name}", match.start(), match.end())
+        for match in self._pem.finditer(text):
+            footer = f"-----END {match.group(1)}-----"
+            end = text.find(footer, match.end())
+            # An incomplete envelope is conservatively covered through end of input.
+            yield Finding(
+                "secret_private_key", match.start(), len(text) if end < 0 else end + len(footer)
+            )
+
+    def scan(self, text: str, *, stage: Stage) -> Check:
+        return _decision(self._find(text), self.action, "[SECRET]")
+
+
+class InvisibleScanner:
+    """Flag Unicode Cc/Cf except tab, CR, and LF; warning is the non-destructive default."""
+
+    name = "invisible"
+
+    def __init__(self, *, action: Action = Action.WARN):
+        _validate_action(action)
+        self.action = action
+
+    def scan(self, text: str, *, stage: Stage) -> Check:
+        findings = (
+            Finding("invisible_control", index, index + 1)
+            for index, char in enumerate(text)
+            if char not in "\t\r\n" and unicodedata.category(char) in ("Cc", "Cf")
+        )
+        return _decision(findings, self.action, "")
+
+
+class LiteralScanner:
+    """Substring policies with exact or ASCII-insensitive matching; no arbitrary regex."""
+
+    name = "literal"
+    _lower = str.maketrans("ABCDEFGHIJKLMNOPQRSTUVWXYZ", "abcdefghijklmnopqrstuvwxyz")
+
+    def __init__(
+        self,
+        literals: Sequence[str],
+        *,
+        action: Action = Action.BLOCK,
+        case_sensitive: bool = True,
+    ):
+        _validate_action(action)
+        if isinstance(literals, str) or not 1 <= len(literals) <= 128:
+            raise ValueError("Supply between 1 and 128 literal strings")
+        if any(not isinstance(item, str) or not 1 <= len(item) <= 1024 for item in literals):
+            raise ValueError("Each literal must contain between 1 and 1024 characters")
+        self._literals = tuple(dict.fromkeys(literals))
+        self.action = action
+        self.case_sensitive = case_sensitive
+
+    def _find(self, text: str) -> Iterable[Finding]:
+        haystack = text if self.case_sensitive else text.translate(self._lower)
+        for literal in self._literals:
+            needle = literal if self.case_sensitive else literal.translate(self._lower)
+            start = haystack.find(needle)
+            while start >= 0:
+                yield Finding("literal_match", start, start + len(literal))
+                start = haystack.find(needle, start + 1)
+
+    def scan(self, text: str, *, stage: Stage) -> Check:
+        return _decision(self._find(text), self.action, "[REDACTED]")

guardtrellis/tools.py

@@ -0,0 +1,87 @@
+"""Tool validation returns data, and never dispatches or authorizes execution."""
+
+from __future__ import annotations
+
+from collections.abc import Mapping, Sequence
+from dataclasses import dataclass, field
+from typing import Any
+
+from .guard import Guard, Scanner
+from .json_check import JSONScanner, Schema, strict_loads
+from .models import Action, Finding, Rejected, Result, Stage
+
+
+@dataclass(frozen=True)
+class ToolResult:
+    validation: Result
+    name: str | None = field(default=None, repr=False)
+    arguments: dict[str, Any] | None = field(default=None, repr=False)
+
+    @property
+    def action(self) -> Action:
+        return self.validation.action
+
+    @property
+    def accepted(self) -> bool:
+        return self.validation.accepted
+
+    def require_call(self) -> tuple[str, dict[str, Any]]:
+        if not self.accepted or self.name is None or self.arguments is None:
+            raise Rejected(f"GuardTrellis rejected tool call: {self.action.value}")
+        return self.name, self.arguments
+
+    def diagnostics(self) -> dict[str, Any]:
+        return self.validation.diagnostics()
+
+
+class ToolGuard:
+    """Exact name allowlist with a separate argument schema for each tool.
+
+    Arguments must arrive as JSON text, enabling duplicate-key detection. A
+    syntax check precedes text policies, and the schema is checked after edits.
+    """
+
+    def __init__(
+        self,
+        tools: Mapping[str, Schema],
+        *,
+        argument_scanners: Sequence[Scanner] = (),
+        max_chars: int = 100_000,
+        timeout_seconds: float = 5.0,
+        max_depth: int = 32,
+    ):
+        if any(not isinstance(name, str) or not 1 <= len(name) <= 128 for name in tools):
+            raise ValueError("Tool names must have between 1 and 128 characters")
+        self._guards = {
+            name: Guard(
+                tool_scanners=(
+                    JSONScanner(max_depth=max_depth, require_object=True),
+                    *argument_scanners,
+                    JSONScanner(schema, max_depth=max_depth, require_object=True),
+                ),
+                max_chars=max_chars,
+                timeout_seconds=timeout_seconds,
+            )
+            for name, schema in tools.items()
+        }
+        self._max_depth = max_depth
+
+    def _unknown(self) -> ToolResult:
+        return ToolResult(Result(Action.BLOCK, Stage.TOOL, None, (Finding("tool_not_allowed"),)))
+
+    def _result(self, name: str, validation: Result) -> ToolResult:
+        if not validation.accepted:
+            return ToolResult(validation)
+        return ToolResult(
+            validation, name, strict_loads(validation.require_text(), max_depth=self._max_depth)
+        )
+
+    def validate(self, name: str, arguments_json: str) -> ToolResult:
+        if not isinstance(name, str) or name not in self._guards:
+            return self._unknown()
+        return self._result(name, self._guards[name].scan(arguments_json, stage=Stage.TOOL))
+
+    async def avalidate(self, name: str, arguments_json: str) -> ToolResult:
+        if not isinstance(name, str) or name not in self._guards:
+            return self._unknown()
+        return self._result(name, await self._guards[name].ascan(arguments_json, stage=Stage.TOOL))

guardtrellis-0.1.0.dist-info/METADATA

@@ -0,0 +1,222 @@
+Metadata-Version: 2.4
+Name: guardtrellis
+Version: 0.1.0
+Summary: Provider-independent local checks for model inputs, outputs, retrieval, and tool calls
+Project-URL: Source, https://github.com/sahilmathur254/guardtrellis
+Project-URL: Issues, https://github.com/sahilmathur254/guardtrellis/issues
+Project-URL: Documentation, https://github.com/sahilmathur254/guardtrellis/blob/main/docs/api.md
+Project-URL: Changelog, https://github.com/sahilmathur254/guardtrellis/blob/main/CHANGELOG.md
+Project-URL: Roadmap, https://github.com/users/sahilmathur254/projects/3
+Author: Sahil Mathur
+License-Expression: Apache-2.0
+License-File: LICENSE
+Classifier: Development Status :: 5 - Production/Stable
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Typing :: Typed
+Requires-Python: <3.15,>=3.11
+Requires-Dist: jsonschema<5,>=4.23
+Requires-Dist: referencing<0.38,>=0.35
+Provides-Extra: fastapi
+Requires-Dist: fastapi<1,>=0.115; extra == 'fastapi'
+Requires-Dist: httpx<1,>=0.27; extra == 'fastapi'
+Requires-Dist: uvicorn<1,>=0.30; extra == 'fastapi'
+Provides-Extra: gemini
+Requires-Dist: google-genai<3,>=2.25; extra == 'gemini'
+Requires-Dist: httpx<1,>=0.28.1; extra == 'gemini'
+Provides-Extra: langgraph
+Requires-Dist: langgraph<2,>=1; extra == 'langgraph'
+Requires-Dist: langsmith<1,>=0.3; extra == 'langgraph'
+Provides-Extra: openai
+Requires-Dist: httpx2<3,>=2.12; extra == 'openai'
+Requires-Dist: openai<4,>=3; extra == 'openai'
+Description-Content-Type: text/markdown
+
+# GuardTrellis
+
+A small Python SDK for local checks around model inputs, complete outputs, retrieved text,
+and proposed tool calls. Policies are explicit, composable, and independent of model providers.
+
+The documented public API is supported across `0.1.x` under the
+[compatibility policy](https://github.com/sahilmathur254/guardtrellis/blob/main/docs/compatibility.md).
+Supported Python: 3.11–3.14. Apache-2.0 licensed.
+
+<!-- guardtrellis-release:start -->
+**Version: `0.1.0`.** See [PyPI](https://pypi.org/project/guardtrellis/0.1.0/)
+for availability and [release notes](https://github.com/sahilmathur254/guardtrellis/releases).
+A source checkout may describe a candidate that has not been published yet.
+
+Install this version in an activated virtual environment:
+
+```sh
+python -m pip install 'guardtrellis==0.1.0'
+```
+
+An explicit version opts into a prerelease when applicable. Optional integrations:
+`'guardtrellis[fastapi]==0.1.0'`,
+`'guardtrellis[langgraph]==0.1.0'`,
+`'guardtrellis[openai]==0.1.0'`,
+`'guardtrellis[gemini]==0.1.0'`.
+<!-- guardtrellis-release:end -->
+
+## Included capabilities
+
+- A [retrieval and tool-call recipe](https://github.com/sahilmathur254/guardtrellis/blob/main/docs/retrieval_tools.md)
+  that carries checked text and validated arguments through both boundaries using core dependencies.
+- A separate [40-case Unicode and PII development set](https://github.com/sahilmathur254/guardtrellis/blob/main/evaluation/challenges/README.md)
+  with synthetic provenance, multilingual context, benign cases, and retained misses and false positives.
+  The original 72-case smoke corpus and its historical results remain available.
+- OpenAI SDK 3 compatibility for the optional OpenAI and Azure examples, using HTTPX2.
+  See the [migration notes](https://github.com/sahilmathur254/guardtrellis/blob/main/docs/openai.md#sdk-3-compatibility)
+  for custom clients and certificate trust changes.
+
+Synthetic results measure the recorded cases and do not establish broader detection accuracy.
+
+## Quickstart
+
+```python
+from guardtrellis import Guard, PIIScanner, SecretScanner
+
+guard = Guard(
+    input_scanners=[SecretScanner(), PIIScanner()],
+    output_scanners=[SecretScanner(), PIIScanner()],
+)
+
+# Deterministic local demonstration, not a real model integration.
+result = guard.run("Contact casey@example.org", lambda text: f"Received: {text}")
+print(result.require_text())  # Received: Contact [PII]
+print(result.diagnostics())  # Metadata only; no matched strings or prompt text.
+```
+
+`run` calls your callback only after accepted input checks, then checks the **complete**
+returned string before exposing it. Use `await guard.arun(text, callback)` for async work;
+both sync and async callbacks work there. Provider SDKs are not required by the core.
+
+| Check | Default | Scope |
+| --- | --- | --- |
+| `PIIScanner` | redact | ASCII email, contiguous international phone, US SSN shapes |
+| `SecretScanner` | block | Selected GitHub tokens, AWS access-key IDs, PEM private keys |
+| `InvisibleScanner` | warn | Unicode control/format characters except tab and newlines |
+| `LiteralScanner([...])` | block | Configured literal substrings; optional ASCII case folding |
+| `JSONScanner(schema)` | block invalid data | Strict JSON and constrained Draft 2020-12 schemas |
+| `ToolGuard({name: schema})` | block invalid calls | Exact tool names and object argument schemas |
+
+No scanners are installed implicitly: `Guard()` permits bounded text. Choose policies for each
+boundary. Heuristic matches are signals, not probabilities or comprehensive protection.
+
+```python
+from guardtrellis import Action, Guard, JSONScanner, LiteralScanner, Stage, ToolGuard
+
+guard = Guard(
+    retrieval_scanners=[LiteralScanner(["confidential"], action=Action.BLOCK)],
+    output_scanners=[JSONScanner({"type": "object", "required": ["answer"]})],
+)
+retrieval = guard.scan("A public reference", stage=Stage.RETRIEVAL)
+# In async code: await guard.ascan("A public reference", stage=Stage.RETRIEVAL)
+
+tools = ToolGuard(
+    {
+        "search": {
+            "type": "object",
+            "properties": {"query": {"type": "string", "maxLength": 200}},
+            "required": ["query"],
+            "additionalProperties": False,
+        },
+    }
+)
+call = tools.validate("search", '{"query":"public documentation"}')
+name, arguments = call.require_call()
+# Your application must still enforce identity, permissions, and execution limits.
+```
+
+`ALLOW`, `WARN`, and `REDACT` expose `result.text`; `BLOCK` and `ERROR` expose `None`.
+`require_text()` / `require_call()` raise a payload-free `Rejected` exception on rejection.
+WARN deliberately permits delivery. Scanner/callback exceptions are errors, never successful
+checks. The first block/error stops its stage. Input rejection prevents the callback entirely.
+
+Stages have separate scanner lists: `input_scanners`, `output_scanners`, `retrieval_scanners`,
+and `tool_scanners`. Use `scan(text, stage=Stage.INPUT/OUTPUT/RETRIEVAL/TOOL)` or `ascan`;
+the default stage is `Stage.INPUT`. Retrieval/tool checks must be invoked explicitly;
+`run` does not discover or intercept these operations. `ToolGuard` adds name/schema validation.
+
+Scanners run in configuration order. Each sees the text produced by preceding redactions.
+Findings record half-open character offsets, scanner index, and the **input revision** they
+refer to; every redacting scanner increments the revision. Offsets from different revisions
+must not be applied to the original string. No originals or rehydration maps are retained.
+
+Defaults: 100,000 characters per stage, 256 findings per scanner, JSON nesting at most 32,
+and a 5-second **per-operation async wait**. Synchronous calls have no execution deadline.
+Async cancellation cannot terminate a running thread or preempt a coroutine that blocks
+the event loop. Timed-out work may continue and have side effects. Use process isolation
+and application concurrency limits when execution must be forcibly bounded.
+
+## Examples and development
+
+Clone the source to run the examples or contribute:
+
+```sh
+git clone https://github.com/sahilmathur254/guardtrellis.git
+cd guardtrellis
+uv sync --all-extras --group dev
+uv run python examples/plain_callable.py
+uv run python examples/retrieval_tools.py   # Checked retrieval through a proposed tool call
+uv run python examples/fastapi_app.py       # Local TestClient demo, no server needed
+uv run python examples/langgraph_app.py     # Local graph, no provider credentials
+uv run python examples/openai_app.py        # Real SDK, in-memory HTTP mock by default
+uv run python examples/azure_openai_app.py  # Azure SDK, in-memory HTTP mock by default
+uv run python examples/gemini_app.py        # Gemini SDK, in-memory HTTP mock by default
+uv run pytest
+uv run ruff check .
+uv run ruff format --check .
+uv run mypy
+uv run python evaluation/run.py --report-dir /tmp/guardtrellis-eval
+uv build
+uv run python scripts/smoke_dist.py
+```
+
+The [retrieval/tool-call recipe](https://github.com/sahilmathur254/guardtrellis/blob/main/docs/retrieval_tools.md)
+uses only core dependencies and shows checked data crossing both boundaries, rejected callbacks,
+and host authorization.
+
+FastAPI and LangGraph are optional extras (`.[fastapi]`, `.[langgraph]`). LangGraph input
+checks run **before** text enters graph state. The example also checks model output before
+returning it to graph state. Instrumentation around callbacks may still capture raw data.
+
+The optional provider examples (`.[openai]`) use direct OpenAI Responses or Azure OpenAI
+Chat Completions through guarded callbacks. Their default modes and ordinary tests make
+no provider calls. See the [OpenAI guide](https://github.com/sahilmathur254/guardtrellis/blob/main/docs/openai.md)
+and [Azure guide](https://github.com/sahilmathur254/guardtrellis/blob/main/docs/azure_openai.md)
+for setup, privacy/failure boundaries, and separately approved one-request live smokes.
+The `openai` extra now requires `openai>=3,<4` and `httpx2>=2.12,<3`; custom clients
+must follow the SDK 3 migration notes above. Live verification of both paths is pending.
+
+The separate [Gemini example](https://github.com/sahilmathur254/guardtrellis/blob/main/docs/gemini.md)
+uses the optional `.[gemini]` extra and also defaults to mocked HTTP. Its one-request live smoke can use an approved Gemini Free Tier
+project with the documented model and limits. A maintainer-approved live smoke passed on
+2026-09-26; the guide records the exact source, versions, token counts, and evidence limits.
+
+See [API details](https://github.com/sahilmathur254/guardtrellis/blob/main/docs/api.md),
+[limitations and trust boundaries](https://github.com/sahilmathur254/guardtrellis/blob/main/docs/limitations.md),
+[evaluation methodology](https://github.com/sahilmathur254/guardtrellis/blob/main/evaluation/README.md),
+[measured smoke results](https://github.com/sahilmathur254/guardtrellis/blob/main/evaluation/REPORT.md),
+[Unicode and PII challenges](https://github.com/sahilmathur254/guardtrellis/blob/main/evaluation/challenges/README.md),
+[resource measurements and host controls](https://github.com/sahilmathur254/guardtrellis/blob/main/docs/resource_limits.md),
+and [contribution guidance](https://github.com/sahilmathur254/guardtrellis/blob/main/CONTRIBUTING.md).
+These checks do not provide comprehensive
+prompt-injection prevention, factual verification, regulatory compliance, or a tool sandbox.
+
+## Roadmap and contributions
+
+Use the public [GitHub Project](https://github.com/users/sahilmathur254/projects/3) to find
+ready work and track progress. The [roadmap](https://github.com/sahilmathur254/guardtrellis/blob/main/ROADMAP.md) explains the release milestones,
+dependencies, and longer-term proposals. Start with a
+[good first issue](https://github.com/sahilmathur254/guardtrellis/labels/good%20first%20issue)
+or a [help wanted issue](https://github.com/sahilmathur254/guardtrellis/labels/help%20wanted),
+then follow the [contributor workflow](https://github.com/sahilmathur254/guardtrellis/blob/main/CONTRIBUTING.md).
+
+See the [changelog](https://github.com/sahilmathur254/guardtrellis/blob/main/CHANGELOG.md)
+for version-specific behavior and the [release guide](https://github.com/sahilmathur254/guardtrellis/blob/main/docs/releasing.md)
+for packaging checks, TestPyPI rehearsal, and maintainer-approved publication.

guardtrellis-0.1.0.dist-info/RECORD

@@ -0,0 +1,11 @@
+guardtrellis/__init__.py,sha256=YpcsC0mWBXKuF_CO3xmNb_wdK5VBRcKec0nvJzDjgDE,713
+guardtrellis/guard.py,sha256=yJO_AcWD9hIK0rU73DmCvrEwvXnP724T3fbqh0pqlcI,10925
+guardtrellis/json_check.py,sha256=FOiNiUfgJ7jrbvQ_6W6Lqsy4WopI7yCa1jdxAbHOi4Q,6269
+guardtrellis/models.py,sha256=gGBXVnx_fzLA19VSmrBBcpQhRbc7Hfkxt9XwLp5i9xo,4129
+guardtrellis/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+guardtrellis/scanners.py,sha256=aqqhn4ptKhlJx5kDbZ-nmnRkPBdKIYV7VgGhztaHYjY,6299
+guardtrellis/tools.py,sha256=SEEcglZ5WLtP_3oE-dihZcyOomAk8opihkb-1eI27vU,3224
+guardtrellis-0.1.0.dist-info/METADATA,sha256=wb-nH-U52TkhhfgaQ2G5HUybT7zzZEk-IRRMmda9jOw,12028
+guardtrellis-0.1.0.dist-info/WHEEL,sha256=W3fkpkm7-wf9vBI5Z-7s0eWkeM-spu78I8Neb98DeEg,87
+guardtrellis-0.1.0.dist-info/licenses/LICENSE,sha256=z8d0m5b2O9McPEK1xHG_dWgUBT6EfBDz6wA0F7xSPTA,11358
+guardtrellis-0.1.0.dist-info/RECORD,,

guardtrellis-0.1.0.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: hatchling 1.32.4
+Root-Is-Purelib: true
+Tag: py3-none-any

guardtrellis-0.1.0.dist-info/licenses/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.