neuraltrust-haystack 0.1.0__py3-none-any.whl

haystack_integrations/components/guardrails/neuraltrust/__init__.py

@@ -0,0 +1,25 @@
+"""NeuralTrust guardrails for Haystack text and chat pipelines."""
+
+from ._version import __version__
+from .chat_guard import NeuralTrustChatGuard
+from .errors import (
+    NeuralTrustAuthenticationError,
+    NeuralTrustBlockedError,
+    NeuralTrustError,
+    NeuralTrustInvalidResponseError,
+    NeuralTrustRequestError,
+    NeuralTrustUnavailableError,
+)
+from .guard import NeuralTrustGuard
+
+__all__ = [
+    "NeuralTrustAuthenticationError",
+    "NeuralTrustBlockedError",
+    "NeuralTrustChatGuard",
+    "NeuralTrustError",
+    "NeuralTrustGuard",
+    "NeuralTrustInvalidResponseError",
+    "NeuralTrustRequestError",
+    "NeuralTrustUnavailableError",
+    "__version__",
+]

haystack_integrations/components/guardrails/neuraltrust/_base.py

@@ -0,0 +1,247 @@
+"""Configuration, request building and safe transformation shared by the components."""
+
+import ipaddress
+import math
+from copy import deepcopy
+from types import TracebackType
+from typing import Any, Literal, TypeVar
+from urllib.parse import urlsplit
+
+from haystack import default_from_dict, default_to_dict
+from haystack.utils import Secret
+
+from ._client import TrustGuardClient, validate_json
+from .errors import NeuralTrustBlockedError, NeuralTrustInvalidResponseError
+
+_GuardT = TypeVar("_GuardT", bound="NeuralTrustBase")
+_DEFAULT_API_KEY = Secret.from_env_var("TRUSTGUARD_API_KEY")
+
+
+def _api_base(value: str) -> str:
+    if not isinstance(value, str):
+        raise TypeError("api_base must be a string.")
+    if not value or any(char.isspace() or ord(char) < 32 for char in value) or "\\" in value:
+        raise ValueError("api_base must be an HTTPS origin or base path without credentials, query or fragment.")
+    try:
+        parsed = urlsplit(value)
+        hostname = parsed.hostname
+        port = parsed.port
+        if (
+            not hostname
+            or parsed.username is not None
+            or parsed.password is not None
+            or parsed.query
+            or parsed.fragment
+        ):
+            raise ValueError
+        if "?" in value or "#" in value or (port is not None and not 1 <= port <= 65535):
+            raise ValueError
+        loopback = hostname.lower() == "localhost"
+        if not loopback:
+            try:
+                loopback = ipaddress.ip_address(hostname).is_loopback
+            except ValueError:
+                pass
+        if parsed.scheme != "https" and not (parsed.scheme == "http" and loopback):
+            raise ValueError
+    except ValueError:
+        raise ValueError("api_base requires HTTPS; HTTP is allowed only for loopback hosts.") from None
+    return value.rstrip("/")
+
+
+def _optional_id(value: str | None, name: str) -> None:
+    if value is not None and (not isinstance(value, str) or not value.strip()):
+        raise ValueError(f"{name} must be a nonempty string when provided.")
+
+
+def validate_text(value: str) -> None:
+    if not isinstance(value, str):
+        raise TypeError("Guard content must be a string.")
+    if not value.strip():
+        raise ValueError("Guard content must not be empty or whitespace-only.")
+
+
+def transformed_texts(payload: Any, messages: list[dict[str, Any]]) -> list[str]:
+    """Map only a validated, unambiguous text transform onto the original messages."""
+    invalid = "TrustGuard returned a missing, unsupported or ambiguous text transformation."
+    if not isinstance(payload, dict):
+        raise NeuralTrustInvalidResponseError(invalid)
+    if "messages" in payload:
+        transformed = payload["messages"]
+        if "input" in payload or not isinstance(transformed, list) or len(transformed) != len(messages):
+            raise NeuralTrustInvalidResponseError(invalid)
+        result: list[str] = []
+        for original, replacement in zip(messages, transformed, strict=True):
+            if (
+                not isinstance(replacement, dict)
+                or not set(replacement).issubset({"role", "content", "name"})
+                or replacement.get("role") != original["role"]
+                or ("name" in replacement and replacement["name"] != original.get("name"))
+            ):
+                raise NeuralTrustInvalidResponseError(invalid)
+            text = replacement.get("content")
+            if not isinstance(text, str) or not text.strip():
+                raise NeuralTrustInvalidResponseError(invalid)
+            result.append(text)
+        return result
+    text = payload.get("input")
+    if len(messages) != 1 or not isinstance(text, str) or not text.strip():
+        raise NeuralTrustInvalidResponseError(invalid)
+    return [text]
+
+
+class NeuralTrustBase:
+    """Common configuration for the text and chat guards.
+
+    ``api_key`` is a Haystack Secret, resolved only at evaluation time. Use an
+    environment-variable Secret for pipeline serialization. ``collector_key`` is
+    an optional nonsecret collector selector for service-token authentication.
+    Collector API keys do not need a selector.
+
+    ``max_retries`` is the number of additional attempts (0 through 10), for
+    connection failures, timeouts and HTTP 429/502/504 only. ``timeout`` is the
+    HTTPX timeout in seconds for each network operation, not an overall deadline.
+    ``on_violation='route'`` omits the content socket on block/ask; all evaluation
+    errors still raise. No implicit approval or failure bypass is available.
+
+    HTTP connections are pooled. Use ``with guard`` for synchronous execution or
+    ``async with guard`` for async execution, or call ``close()`` / ``aclose()``
+    explicitly. Each event loop owns its async pool and must close it before
+    stopping. A guard can mix sync and async calls and can be reused after close.
+    """
+
+    def __init__(
+        self,
+        *,
+        api_key: Secret = _DEFAULT_API_KEY,
+        api_base: str = "https://trustguard.neuraltrust.ai",
+        direction: Literal["input", "output"] = "input",
+        on_violation: Literal["raise", "route"] = "raise",
+        timeout: float = 5.0,
+        max_retries: int = 2,
+        collector_key: str | None = None,
+    ) -> None:
+        if not isinstance(api_key, Secret):
+            raise TypeError("api_key must be a Haystack Secret.")
+        if direction not in ("input", "output"):
+            raise ValueError("direction must be 'input' or 'output'.")
+        if on_violation not in ("raise", "route"):
+            raise ValueError("on_violation must be 'raise' or 'route'.")
+        if (
+            isinstance(timeout, bool)
+            or not isinstance(timeout, (int, float))
+            or not math.isfinite(timeout)
+            or timeout <= 0
+        ):
+            raise ValueError("timeout must be a finite positive number of seconds.")
+        if isinstance(max_retries, bool) or not isinstance(max_retries, int) or not 0 <= max_retries <= 10:
+            raise ValueError("max_retries must be an integer between 0 and 10.")
+        _optional_id(collector_key, "collector_key")
+        self.api_key = api_key
+        self.api_base = _api_base(api_base)
+        self.direction = direction
+        self.on_violation = on_violation
+        self.timeout = float(timeout)
+        self.max_retries = max_retries
+        self.collector_key = collector_key
+        self._client = TrustGuardClient(
+            api_key=self.api_key,
+            endpoint=f"{self.api_base}/v1/evaluate",
+            timeout=self.timeout,
+            max_retries=self.max_retries,
+        )
+
+    def close(self) -> None:
+        """Drain and close the synchronous pool. Later evaluations may reopen it."""
+        self._client.close()
+
+    async def aclose(self) -> None:
+        """Drain this event loop's async pool and the synchronous pool.
+
+        Call before the owning loop stops. Pools in other loops are unaffected.
+        Cancellation does not interrupt cleanup; evaluations started after
+        cleanup begins may create a new pool.
+        """
+        await self._client.aclose()
+
+    def __enter__(self: _GuardT) -> _GuardT:
+        return self
+
+    def __exit__(
+        self, exc_type: type[BaseException] | None, exc_value: BaseException | None, traceback: TracebackType | None
+    ) -> None:
+        self.close()
+
+    async def __aenter__(self: _GuardT) -> _GuardT:
+        return self
+
+    async def __aexit__(
+        self, exc_type: type[BaseException] | None, exc_value: BaseException | None, traceback: TracebackType | None
+    ) -> None:
+        await self.aclose()
+
+    def to_dict(self) -> dict[str, Any]:
+        """Serialize configuration without resolving or serializing the API credential."""
+        return default_to_dict(
+            self,
+            api_key=self.api_key.to_dict(),
+            api_base=self.api_base,
+            direction=self.direction,
+            on_violation=self.on_violation,
+            timeout=self.timeout,
+            max_retries=self.max_retries,
+            collector_key=self.collector_key,
+        )
+
+    @classmethod
+    def from_dict(cls: type[_GuardT], data: dict[str, Any]) -> _GuardT:
+        """Deserialize a component without modifying the caller's configuration dictionary."""
+        copied = deepcopy(data)
+        params = copied.get("init_parameters", {})
+        if isinstance(params.get("api_key"), dict):
+            params["api_key"] = Secret.from_dict(params["api_key"])
+        return default_from_dict(cls, copied)
+
+    def _body(
+        self,
+        messages: list[dict[str, Any]],
+        *,
+        session_id: str | None,
+        consumer_id: str | None,
+        attributes: dict[str, Any] | None,
+    ) -> dict[str, Any]:
+        _optional_id(session_id, "session_id")
+        _optional_id(consumer_id, "consumer_id")
+        if attributes is not None and not isinstance(attributes, dict):
+            raise TypeError("attributes must be a JSON-compatible dictionary.")
+        try:
+            validate_json(attributes)
+        except (ValueError, RecursionError):
+            raise ValueError(
+                "attributes must contain JSON-compatible values with string keys and finite numbers."
+            ) from None
+        copied_attributes = deepcopy(attributes) if attributes is not None else {}
+        source = copied_attributes.setdefault("source", {})
+        if not isinstance(source, dict):
+            raise ValueError("attributes.source must be a JSON-compatible dictionary.")
+        source.setdefault("application", "haystack")
+        body: dict[str, Any] = {
+            "payload": {"messages": messages},
+            "direction": self.direction,
+            "protocol": "llm",
+            "attributes": copied_attributes,
+        }
+        if session_id is not None:
+            body["session_id"] = session_id
+        if consumer_id is not None:
+            body["consumer_id"] = consumer_id
+        if self.collector_key is not None:
+            body["collector_key"] = self.collector_key
+        return body
+
+    def _is_blocked(self, verdict: dict[str, Any]) -> bool:
+        if verdict["status"] not in ("block", "ask"):
+            return False
+        if self.on_violation == "raise":
+            raise NeuralTrustBlockedError(verdict)
+        return True

haystack_integrations/components/guardrails/neuraltrust/_client.py

@@ -0,0 +1,374 @@
+"""Bounded, fail-closed synchronous and asynchronous TrustGuard transport."""
+
+import asyncio
+import json
+import math
+import re
+import ssl
+import threading
+import time
+from collections.abc import AsyncIterator, Iterator
+from contextlib import asynccontextmanager, contextmanager
+from copy import deepcopy
+from datetime import datetime, timezone
+from email.utils import parsedate_to_datetime
+from functools import partial
+from typing import Any
+
+import httpx
+from haystack.utils import Secret
+
+from ._version import __version__
+from .errors import (
+    NeuralTrustAuthenticationError,
+    NeuralTrustInvalidResponseError,
+    NeuralTrustRequestError,
+    NeuralTrustUnavailableError,
+)
+
+_RETRY_STATUSES = frozenset({429, 502, 504})
+_STATUSES = frozenset({"allow", "report", "transform", "ask", "block"})
+_CORRELATION_ID = re.compile(r"[A-Za-z0-9._:-]{1,256}\Z")
+
+
+def _unique_object(pairs: list[tuple[str, Any]]) -> dict[str, Any]:
+    result: dict[str, Any] = {}
+    for key, value in pairs:
+        if key in result:
+            raise ValueError("Duplicate JSON field")
+        result[key] = value
+    return result
+
+
+def _invalid_constant(_: str) -> None:
+    raise ValueError("Non-finite JSON number")
+
+
+def validate_json(value: Any) -> None:
+    """Validate JSON without silently coercing Python values or dictionary keys."""
+    if value is None or isinstance(value, (str, bool, int)):
+        return
+    if isinstance(value, float) and math.isfinite(value):
+        return
+    if isinstance(value, list):
+        for item in value:
+            validate_json(item)
+        return
+    if isinstance(value, dict) and all(isinstance(key, str) for key in value):
+        for item in value.values():
+            validate_json(item)
+        return
+    raise ValueError("Expected JSON-compatible values with string object keys and finite numbers.")
+
+
+def parse_response(response: httpx.Response) -> tuple[dict[str, Any], Any]:
+    """Return an allowlisted verdict and an untrusted transform for later validation."""
+    try:
+        data = json.loads(response.content, parse_constant=_invalid_constant, object_pairs_hook=_unique_object)
+    except (ValueError, UnicodeError, RecursionError):
+        raise NeuralTrustInvalidResponseError("TrustGuard returned invalid JSON.") from None
+    if not isinstance(data, dict) or not isinstance(data.get("status"), str):
+        raise NeuralTrustInvalidResponseError("TrustGuard returned a malformed verdict.")
+    status = data["status"].strip().lower()
+    if status not in _STATUSES:
+        raise NeuralTrustInvalidResponseError("TrustGuard returned an unsupported verdict status.")
+    verdict: dict[str, Any] = {"status": status}
+    if "findings" in data:
+        findings = data["findings"]
+        if not isinstance(findings, list) or not all(isinstance(finding, dict) for finding in findings):
+            raise NeuralTrustInvalidResponseError("TrustGuard returned malformed findings.")
+        try:
+            validate_json(findings)
+        except (ValueError, RecursionError):
+            raise NeuralTrustInvalidResponseError("TrustGuard returned malformed findings.") from None
+        verdict["findings"] = deepcopy(findings)
+    for key in ("trace_id", "request_id"):
+        if key in data:
+            if not isinstance(data[key], str) or _CORRELATION_ID.fullmatch(data[key]) is None:
+                raise NeuralTrustInvalidResponseError("TrustGuard returned a malformed correlation ID.")
+            verdict[key] = data[key]
+    return verdict, data.get("transformed_payload")
+
+
+def _retry_delay(attempt: int, response: httpx.Response | None = None) -> float:
+    if response is not None and (header := response.headers.get("Retry-After")):
+        try:
+            delay = float(header)
+        except ValueError:
+            try:
+                retry_at = parsedate_to_datetime(header)
+                if retry_at.tzinfo is None:
+                    retry_at = retry_at.replace(tzinfo=timezone.utc)
+                delay = (retry_at - datetime.now(timezone.utc)).total_seconds()
+            except (ValueError, TypeError, OverflowError):
+                delay = -1.0
+        if math.isfinite(delay) and delay >= 0:
+            return min(delay, 5.0)
+    return float(min(0.25 * 2**attempt, 2.0))
+
+
+def _tls_failure(error: BaseException) -> bool:
+    current: BaseException | None = error
+    visited: set[int] = set()
+    while current is not None and id(current) not in visited:
+        visited.add(id(current))
+        if isinstance(current, ssl.SSLError):
+            return True
+        if any(hint in str(current).lower() for hint in ("certificate", "ssl", "tls")):
+            return True
+        current = current.__cause__ or current.__context__
+    return False
+
+
+def _check_status(response: httpx.Response) -> bool:
+    """Return whether to retry, otherwise accept 200 or raise a sanitized error."""
+    status_code = response.status_code
+    if status_code == 200:
+        return False
+    if status_code in (401, 403):
+        raise NeuralTrustAuthenticationError(
+            "TrustGuard authentication or authorization failed.", status_code=status_code
+        )
+    if status_code in _RETRY_STATUSES:
+        return True
+    raise NeuralTrustRequestError("TrustGuard rejected the evaluation request.", status_code=status_code)
+
+
+class _SyncPool:
+    """A client generation that can drain independently of a replacement pool."""
+
+    def __init__(self, timeout: float) -> None:
+        self.client = httpx.Client(timeout=timeout, follow_redirects=False)
+        self.condition = threading.Condition()
+        self.active = 0
+
+    def close(self) -> None:
+        with self.condition:
+            self.condition.wait_for(lambda: self.active == 0)
+            if not self.client.is_closed:
+                self.client.close()
+
+
+async def _new_async_client(timeout: float) -> httpx.AsyncClient:
+    # Client construction loads TLS certificates synchronously. An executor
+    # future (rather than a second Task) survives event-loop shutdown cancellation
+    # long enough to dispose of an unused client, including a late worker result.
+    pending = asyncio.get_running_loop().run_in_executor(
+        None, partial(httpx.AsyncClient, timeout=timeout, follow_redirects=False)
+    )
+    try:
+        return await asyncio.shield(pending)
+    except asyncio.CancelledError:
+        while not pending.done():
+            try:
+                await asyncio.shield(pending)
+            except asyncio.CancelledError:
+                continue
+        if not pending.cancelled() and pending.exception() is None:
+            await pending.result().aclose()
+        raise
+
+
+class _AsyncPool:
+    """All state and network operations belong to the creating event loop."""
+
+    def __init__(self, timeout: float) -> None:
+        self.initialization = asyncio.create_task(_new_async_client(timeout))
+        # Retrieve failures even when all callers were cancelled before setup
+        # completed; the exception is still raised to every awaiting evaluation.
+        self.initialization.add_done_callback(lambda task: None if task.cancelled() else task.exception())
+        self.active = 0
+        self.idle = asyncio.Event()
+        self.idle.set()
+
+    async def close(self) -> None:
+        await self.idle.wait()
+        try:
+            client = await asyncio.shield(self.initialization)
+        except Exception:
+            return  # Construction failed, so there is no client to dispose of.
+        await client.aclose()
+
+
+class TrustGuardClient:
+    """Lazy, reusable HTTP pools; async pools are owned by individual event loops.
+
+    ``close()`` drains the synchronous pool. ``aclose()`` drains the current
+    event loop's async pool and the synchronous pool. Close async pools in their
+    owning loop before stopping it. Evaluations started after cleanup begins
+    may create a fresh pool; cleanup never closes another loop's connections.
+    """
+
+    def __init__(self, *, api_key: Secret, endpoint: str, timeout: float, max_retries: int) -> None:
+        self.api_key = api_key
+        self.endpoint = endpoint
+        self.timeout = timeout
+        self.max_retries = max_retries
+        self._sync_lock = threading.Lock()
+        self._sync_pool: _SyncPool | None = None
+        self._sync_closing: set[_SyncPool] = set()
+        self._async_lock = threading.Lock()
+        self._async_pools: dict[asyncio.AbstractEventLoop, _AsyncPool] = {}
+        self._async_closing: dict[asyncio.AbstractEventLoop, set[asyncio.Task[None]]] = {}
+
+    def __deepcopy__(self, memo: dict[int, Any]) -> "TrustGuardClient":
+        # Haystack may deepcopy components. HTTP pools, locks and event-loop
+        # ownership must never cross into the copied component.
+        copied = type(self)(
+            api_key=deepcopy(self.api_key, memo),
+            endpoint=self.endpoint,
+            timeout=self.timeout,
+            max_retries=self.max_retries,
+        )
+        memo[id(self)] = copied
+        return copied
+
+    @contextmanager
+    def _sync_http(self) -> Iterator[httpx.Client]:
+        with self._sync_lock:
+            if self._sync_pool is None:
+                try:
+                    self._sync_pool = _SyncPool(self.timeout)
+                except Exception:
+                    raise NeuralTrustRequestError("TrustGuard transport initialization failed.") from None
+            pool = self._sync_pool
+            with pool.condition:
+                pool.active += 1
+        try:
+            yield pool.client
+        finally:
+            with pool.condition:
+                pool.active -= 1
+                pool.condition.notify_all()
+
+    @asynccontextmanager
+    async def _async_http(self) -> AsyncIterator[httpx.AsyncClient]:
+        loop = asyncio.get_running_loop()
+        with self._async_lock:
+            pool = self._async_pools.get(loop)
+            if pool is None:
+                pool = _AsyncPool(self.timeout)
+                self._async_pools[loop] = pool
+            pool.active += 1
+            pool.idle.clear()
+        try:
+            try:
+                client = await asyncio.shield(pool.initialization)
+            except Exception:
+                with self._async_lock:
+                    if self._async_pools.get(loop) is pool:
+                        del self._async_pools[loop]
+                raise NeuralTrustRequestError("TrustGuard transport initialization failed.") from None
+            yield client
+        finally:
+            pool.active -= 1
+            if not pool.active:
+                pool.idle.set()
+
+    def close(self) -> None:
+        """Drain sync evaluations and close their pool; later calls may reopen it."""
+        with self._sync_lock:
+            if self._sync_pool is not None:
+                self._sync_closing.add(self._sync_pool)
+                self._sync_pool = None
+            pools = tuple(self._sync_closing)
+        for pool in pools:
+            pool.close()
+            with self._sync_lock:
+                self._sync_closing.discard(pool)
+
+    def _finished_close(self, loop: asyncio.AbstractEventLoop, task: asyncio.Task[None]) -> None:
+        with self._async_lock:
+            pending = self._async_closing.get(loop)
+            if pending is not None:
+                pending.discard(task)
+                if not pending:
+                    del self._async_closing[loop]
+        if not task.cancelled():
+            task.exception()
+
+    async def aclose(self) -> None:
+        """Drain this loop's async pool and the sync pool without blocking the loop.
+
+        Cancellation of the caller does not cancel cleanup. Another ``aclose``
+        call can await cleanup that is still running.
+        """
+        loop = asyncio.get_running_loop()
+        with self._async_lock:
+            pool = self._async_pools.pop(loop, None)
+            pending = self._async_closing.setdefault(loop, set())
+            if pool is not None:
+                task = asyncio.create_task(pool.close())
+                pending.add(task)
+                task.add_done_callback(partial(self._finished_close, loop))
+            sync_close = asyncio.create_task(asyncio.to_thread(self.close))
+            pending.add(sync_close)
+            sync_close.add_done_callback(partial(self._finished_close, loop))
+            tasks = tuple(pending)
+        for task in tasks:
+            try:
+                await asyncio.shield(task)
+            finally:
+                if task.done():
+                    self._finished_close(loop, task)
+
+    def _headers(self) -> dict[str, str]:
+        try:
+            token = self.api_key.resolve_value()
+        except Exception:
+            raise NeuralTrustAuthenticationError("The TrustGuard API credential could not be resolved.") from None
+        if not isinstance(token, str) or not token or any(ord(char) < 33 or ord(char) > 126 for char in token):
+            raise NeuralTrustAuthenticationError("The TrustGuard API credential is missing or invalid.")
+        return {
+            "Authorization": f"Bearer {token}",
+            "Content-Type": "application/json",
+            "User-Agent": f"neuraltrust-haystack/{__version__}",
+        }
+
+    def evaluate(self, body: dict[str, Any]) -> tuple[dict[str, Any], Any]:
+        headers = self._headers()
+        with self._sync_http() as client:
+            for attempt in range(self.max_retries + 1):
+                response = None
+                try:
+                    response = client.post(self.endpoint, json=body, headers=headers)
+                except (httpx.TimeoutException, httpx.ConnectError) as error:
+                    if _tls_failure(error):
+                        raise NeuralTrustRequestError("TrustGuard TLS verification failed.") from None
+                    if attempt == self.max_retries:
+                        raise NeuralTrustUnavailableError("TrustGuard evaluation is unavailable.") from None
+                except httpx.RequestError:
+                    raise NeuralTrustRequestError("TrustGuard evaluation transport failed.") from None
+                else:
+                    if not _check_status(response):
+                        return parse_response(response)
+                    if attempt == self.max_retries:
+                        raise NeuralTrustUnavailableError(
+                            "TrustGuard evaluation is unavailable.", status_code=response.status_code
+                        )
+                time.sleep(_retry_delay(attempt, response))
+        raise AssertionError("Unreachable retry state")
+
+    async def evaluate_async(self, body: dict[str, Any]) -> tuple[dict[str, Any], Any]:
+        headers = self._headers()
+        async with self._async_http() as client:
+            for attempt in range(self.max_retries + 1):
+                response = None
+                try:
+                    response = await client.post(self.endpoint, json=body, headers=headers)
+                except (httpx.TimeoutException, httpx.ConnectError) as error:
+                    if _tls_failure(error):
+                        raise NeuralTrustRequestError("TrustGuard TLS verification failed.") from None
+                    if attempt == self.max_retries:
+                        raise NeuralTrustUnavailableError("TrustGuard evaluation is unavailable.") from None
+                except httpx.RequestError:
+                    raise NeuralTrustRequestError("TrustGuard evaluation transport failed.") from None
+                else:
+                    if not _check_status(response):
+                        return parse_response(response)
+                    if attempt == self.max_retries:
+                        raise NeuralTrustUnavailableError(
+                            "TrustGuard evaluation is unavailable.", status_code=response.status_code
+                        )
+                await asyncio.sleep(_retry_delay(attempt, response))
+        raise AssertionError("Unreachable retry state")

haystack_integrations/components/guardrails/neuraltrust/_version.py

@@ -0,0 +1,3 @@
+"""Package version."""
+
+__version__ = "0.1.0"

haystack_integrations/components/guardrails/neuraltrust/chat_guard.py

@@ -0,0 +1,99 @@
+"""Haystack component for unambiguous text-only ChatMessage conversations."""
+
+from copy import deepcopy
+from typing import Any
+
+from haystack import component
+from haystack.dataclasses import ChatMessage, ChatRole
+
+from ._base import NeuralTrustBase, transformed_texts, validate_text
+
+
+def _prepare_messages(messages: list[ChatMessage]) -> tuple[list[ChatMessage], list[dict[str, Any]]]:
+    if not isinstance(messages, list):
+        raise TypeError("messages must be a list of Haystack ChatMessage objects.")
+    # Derive the request and result from the same snapshot, even if another
+    # pipeline branch modifies the caller's list or messages concurrently.
+    originals = deepcopy(messages)
+    if not originals:
+        raise ValueError("messages must not be empty.")
+    payload: list[dict[str, Any]] = []
+    for message in originals:
+        if not isinstance(message, ChatMessage):
+            raise TypeError("messages must contain only Haystack ChatMessage objects.")
+        if (
+            not isinstance(message.role, ChatRole)
+            or message.role not in (ChatRole.SYSTEM, ChatRole.USER, ChatRole.ASSISTANT)
+            or len(message) != 1
+            or len(message.texts) != 1
+        ):
+            raise ValueError(
+                "Each message must have a system, user or assistant role and exactly one text content part."
+            )
+        text = message.texts[0]
+        validate_text(text)
+        item: dict[str, Any] = {"role": message.role.value, "content": text}
+        if message.name is not None:
+            if not isinstance(message.name, str) or not message.name.strip():
+                raise ValueError("Message names must be nonempty strings when provided.")
+            item["name"] = message.name
+        payload.append(item)
+    return originals, payload
+
+
+@component
+class NeuralTrustChatGuard(NeuralTrustBase):
+    """Evaluate text-only Haystack messages while preserving order, names and metadata.
+
+    Every message must contain exactly one nonempty text part. Tools, reasoning,
+    files, images, audio and multiple content parts are rejected before evaluation.
+    Connect the ``messages`` output to the next component. Block and ask raise by
+    default; ``on_violation='route'`` emits only ``verdict`` for these statuses.
+    """
+
+    @component.output_types(messages=list[ChatMessage], verdict=dict[str, Any])
+    def run(
+        self,
+        messages: list[ChatMessage],
+        *,
+        session_id: str | None = None,
+        consumer_id: str | None = None,
+        attributes: dict[str, Any] | None = None,
+    ) -> dict[str, Any]:
+        """Evaluate a conversation and return independent copies containing only safe text."""
+        originals, payload = _prepare_messages(messages)
+        body = self._body(payload, session_id=session_id, consumer_id=consumer_id, attributes=attributes)
+        verdict, transformed = self._client.evaluate(body)
+        return self._result(originals, payload, verdict, transformed)
+
+    @component.output_types(messages=list[ChatMessage], verdict=dict[str, Any])
+    async def run_async(
+        self,
+        messages: list[ChatMessage],
+        *,
+        session_id: str | None = None,
+        consumer_id: str | None = None,
+        attributes: dict[str, Any] | None = None,
+    ) -> dict[str, Any]:
+        """Evaluate text-only messages using native async HTTP with the same enforcement as run."""
+        originals, payload = _prepare_messages(messages)
+        body = self._body(payload, session_id=session_id, consumer_id=consumer_id, attributes=attributes)
+        verdict, transformed = await self._client.evaluate_async(body)
+        return self._result(originals, payload, verdict, transformed)
+
+    def _result(
+        self,
+        originals: list[ChatMessage],
+        payload: list[dict[str, Any]],
+        verdict: dict[str, Any],
+        transformed: Any,
+    ) -> dict[str, Any]:
+        if self._is_blocked(verdict):
+            return {"verdict": verdict}
+        if verdict["status"] == "transform":
+            texts = transformed_texts(transformed, payload)
+            for index, (message, text) in enumerate(zip(originals, texts, strict=True)):
+                serialized = deepcopy(message.to_dict())
+                serialized["content"] = [{"text": text}]
+                originals[index] = ChatMessage.from_dict(serialized)
+        return {"messages": originals, "verdict": verdict}

haystack_integrations/components/guardrails/neuraltrust/errors.py

@@ -0,0 +1,41 @@
+"""Sanitized errors raised by the NeuralTrust components."""
+
+from copy import deepcopy
+from typing import Any
+
+
+class NeuralTrustError(RuntimeError):
+    """Base error; request bodies, credentials and raw server errors are never included."""
+
+    def __init__(self, message: str, *, status_code: int | None = None) -> None:
+        super().__init__(message)
+        self.status_code = status_code
+
+
+class NeuralTrustAuthenticationError(NeuralTrustError):
+    """The API credential is missing, invalid, or unauthorized."""
+
+
+class NeuralTrustUnavailableError(NeuralTrustError):
+    """A retryable evaluation failure exhausted the configured retry budget."""
+
+
+class NeuralTrustRequestError(NeuralTrustError):
+    """TrustGuard rejected the request or a non-retryable transport failure occurred."""
+
+
+class NeuralTrustInvalidResponseError(NeuralTrustError):
+    """The response or transformation cannot be safely interpreted."""
+
+
+class NeuralTrustBlockedError(NeuralTrustError):
+    """Evaluation blocked content or requested approval that this component cannot grant.
+
+    ``status`` preserves ``block`` or ``ask``. ``verdict`` contains only that status
+    and validated correlation IDs, never findings, original content or transforms.
+    """
+
+    def __init__(self, verdict: dict[str, Any]) -> None:
+        self.status = verdict["status"]
+        self.verdict = deepcopy({key: verdict[key] for key in ("status", "trace_id", "request_id") if key in verdict})
+        super().__init__(f"TrustGuard stopped content with status '{self.status}'.")

haystack_integrations/components/guardrails/neuraltrust/guard.py

@@ -0,0 +1,62 @@
+"""Haystack component for evaluating individual text inputs and outputs."""
+
+from typing import Any
+
+from haystack import component
+
+from ._base import NeuralTrustBase, transformed_texts, validate_text
+
+
+@component
+class NeuralTrustGuard(NeuralTrustBase):
+    """Evaluate a text string with the policy attached to a TrustGuard collector.
+
+    Connect ``text`` to downstream components so only allowed or validated
+    transformed content proceeds. The ``verdict`` output contains the status,
+    findings when supplied, and correlation IDs. With ``on_violation='route'``,
+    block and ask emit only ``verdict``, without a ``text`` output.
+
+    Set ``direction='output'`` when guarding a model response; its policy phase
+    and request role then become output and assistant respectively.
+    """
+
+    @component.output_types(text=str, verdict=dict[str, Any])
+    def run(
+        self,
+        text: str,
+        *,
+        session_id: str | None = None,
+        consumer_id: str | None = None,
+        attributes: dict[str, Any] | None = None,
+    ) -> dict[str, Any]:
+        """Evaluate nonempty text; optional IDs and attributes provide policy and tracing context."""
+        validate_text(text)
+        messages = [{"role": "user" if self.direction == "input" else "assistant", "content": text}]
+        body = self._body(messages, session_id=session_id, consumer_id=consumer_id, attributes=attributes)
+        verdict, transformed = self._client.evaluate(body)
+        return self._result(text, messages, verdict, transformed)
+
+    @component.output_types(text=str, verdict=dict[str, Any])
+    async def run_async(
+        self,
+        text: str,
+        *,
+        session_id: str | None = None,
+        consumer_id: str | None = None,
+        attributes: dict[str, Any] | None = None,
+    ) -> dict[str, Any]:
+        """Evaluate text using native async HTTP; safe to reuse across separate event loops."""
+        validate_text(text)
+        messages = [{"role": "user" if self.direction == "input" else "assistant", "content": text}]
+        body = self._body(messages, session_id=session_id, consumer_id=consumer_id, attributes=attributes)
+        verdict, transformed = await self._client.evaluate_async(body)
+        return self._result(text, messages, verdict, transformed)
+
+    def _result(
+        self, text: str, messages: list[dict[str, Any]], verdict: dict[str, Any], transformed: Any
+    ) -> dict[str, Any]:
+        if self._is_blocked(verdict):
+            return {"verdict": verdict}
+        if verdict["status"] == "transform":
+            text = transformed_texts(transformed, messages)[0]
+        return {"text": text, "verdict": verdict}

neuraltrust_haystack-0.1.0.dist-info/METADATA

@@ -0,0 +1,255 @@
+Metadata-Version: 2.5
+Name: neuraltrust-haystack
+Version: 0.1.0
+Summary: NeuralTrust TrustGuard security components for Haystack pipelines
+Project-URL: Homepage, https://neuraltrust.ai
+Project-URL: Documentation, https://docs.neuraltrust.ai/integrations/haystack
+Project-URL: Changelog, https://github.com/NeuralTrust/neuraltrust-haystack/blob/main/CHANGELOG.md
+Project-URL: Repository, https://github.com/NeuralTrust/neuraltrust-haystack
+Project-URL: Issues, https://github.com/NeuralTrust/neuraltrust-haystack/issues
+Author: NeuralTrust
+License-Expression: MIT
+License-File: LICENSE
+Keywords: guardrails,haystack,neuraltrust,security,trustguard
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Topic :: Security
+Classifier: Typing :: Typed
+Requires-Python: >=3.10
+Requires-Dist: haystack-ai<4,>=2.31.0
+Requires-Dist: httpx<1,>=0.27
+Description-Content-Type: text/markdown
+
+# neuraltrust-haystack
+
+Add [NeuralTrust TrustGuard](https://neuraltrust.ai) evaluation to Haystack text and chat pipelines. Screen user input before a model runs, or inspect completed assistant replies before returning them to your application.
+
+Read the [official Haystack integration guide](https://docs.neuraltrust.ai/integrations/haystack) for setup and usage documentation.
+
+## Installation
+
+Requires Python 3.10+ and Haystack 2.31 or 3.x (`haystack-ai>=2.31.0,<4`).
+
+```bash
+pip install neuraltrust-haystack
+```
+
+For installation from source and development checks, see the [contributing guide](https://github.com/NeuralTrust/neuraltrust-haystack/blob/main/CONTRIBUTING.md).
+
+## Connect to TrustGuard
+
+Create or select a TrustGuard collector with the policy you want to evaluate, then set its API key in your environment:
+
+```bash
+export TRUSTGUARD_API_KEY="your-collector-api-key"
+```
+
+The default API origin is `https://trustguard.neuraltrust.ai`. Pass `api_base` for the public HTTPS origin of a regional or self-hosted deployment. The component sends evaluation requests to `/v1/evaluate`.
+
+The API key selects the collector and its policy. The input/output direction selects the policy phase. An `allow` result only reflects the configured policy; a collector without applicable checks does not establish that content was scanned for every threat.
+
+## Components
+
+```python
+from haystack_integrations.components.guardrails.neuraltrust import (
+    NeuralTrustChatGuard,
+    NeuralTrustGuard,
+)
+```
+
+| Component | Required run input | Passing output |
+| --- | --- | --- |
+| `NeuralTrustGuard` | `text: str` | `text: str`, `verdict: dict` |
+| `NeuralTrustChatGuard` | `messages: list[ChatMessage]` | `messages: list[ChatMessage]`, `verdict: dict` |
+
+Both components implement `run`, `run_async`, `to_dict`, and `from_dict`.
+
+### Screen text
+
+```python
+from haystack_integrations.components.guardrails.neuraltrust import NeuralTrustGuard
+
+with NeuralTrustGuard() as guard:
+    result = guard.run(text="What is the capital of France?")
+    print(result["text"])
+    print(result["verdict"]["status"])
+```
+
+The default `on_violation="raise"` stops execution with `NeuralTrustBlockedError` for a `block` or `ask` verdict. API and response errors also stop execution.
+
+### Route a pipeline
+
+Use `on_violation="route"` when the application should handle denied requests through the verdict output:
+
+```python
+from haystack import Pipeline, component
+
+from haystack_integrations.components.guardrails.neuraltrust import NeuralTrustGuard
+
+
+@component
+class AcceptText:
+    @component.output_types(accepted=str)
+    def run(self, text: str) -> dict[str, str]:
+        return {"accepted": text}
+
+
+with NeuralTrustGuard(on_violation="route") as guard:
+    pipeline = Pipeline()
+    pipeline.add_component("guard", guard)
+    pipeline.add_component("accept", AcceptText())
+    pipeline.connect("guard.text", "accept.text")
+
+    result = pipeline.run(
+        {"guard": {"text": "What is the capital of France?"}},
+        include_outputs_from={"guard"},
+    )
+    print(result["guard"]["verdict"]["status"])
+    if "accept" in result:
+        print(result["accept"]["accepted"])
+```
+
+On `block` or `ask`, the guard emits only `verdict`. The required `accept.text` input receives no value, so that component does not run. The guard omits the passing socket entirely: emitting an empty string or empty list would still supply a value to a downstream component. Keep guarded content connected through the guard's output, and use required inputs for the protected downstream step.
+
+From a source checkout, the [text example](https://github.com/NeuralTrust/neuraltrust-haystack/blob/main/examples/text_pipeline.py) runs this pattern from the command line:
+
+```bash
+uv run python examples/text_pipeline.py "What is the capital of France?"
+```
+
+### Screen completed chat replies
+
+```python
+from haystack.dataclasses import ChatMessage
+
+from haystack_integrations.components.guardrails.neuraltrust import NeuralTrustChatGuard
+
+with NeuralTrustChatGuard(direction="output") as guard:
+    result = guard.run(messages=[ChatMessage.from_assistant("Paris is the capital of France.")])
+    print(result["messages"][0].text)
+```
+
+Connect `chat_generator.replies` to `guard.messages` to evaluate completed generator replies. In a source checkout, the [chat example](https://github.com/NeuralTrust/neuraltrust-haystack/blob/main/examples/chat_pipeline.py) uses a local component that produces a fixed assistant reply:
+
+```bash
+uv run python examples/chat_pipeline.py
+```
+
+The chat guard accepts a nonempty list of `system`, `user`, and `assistant` messages, each with exactly one nonempty text part, and preserves message names and metadata. Multiple content parts, reasoning, multimodal content, tool calls, and tool results are rejected. Transformed responses must map unambiguously to the original messages; incompatible message counts, roles, or content fail closed. The text guard also rejects empty or whitespace-only input.
+
+### Async execution
+
+```python
+import asyncio
+
+from haystack_integrations.components.guardrails.neuraltrust import NeuralTrustGuard
+
+
+async def main() -> None:
+    async with NeuralTrustGuard() as guard:
+        result = await guard.run_async(text="What is the capital of France?")
+        print(result["verdict"]["status"])
+
+
+asyncio.run(main())
+```
+
+For async pipelines, Haystack 3.x uses `await Pipeline.run_async(...)`; Haystack 2.31 uses `await AsyncPipeline.run_async(...)` with `AsyncPipeline` imported from `haystack`. Synchronous and asynchronous calls use the same component inputs, verdict handling, and error behavior.
+
+### Client lifetime
+
+Reuse guard instances across evaluations to reuse HTTP connections. Synchronous calls share a pool; asynchronous calls use a separate pool for each event loop. Async client and TLS setup runs off the event loop and is shared by concurrent initial calls. Credentials still resolve on every evaluation.
+
+Use `with guard` for synchronous work or `async with guard` around the lifetime of an asynchronous pipeline. At application shutdown, `guard.close()` drains the synchronous pool. `await guard.aclose()` drains both the synchronous pool and the current loop's asynchronous pool. Call it in each owning event loop before that loop stops. Cleanup is idempotent; subsequent evaluations can create a fresh pool. Network clients and locks are excluded from serialization and component copies.
+
+## Configuration
+
+All constructor arguments are keyword-only.
+
+| Argument | Default | Purpose |
+| --- | --- | --- |
+| `api_key` | `Secret.from_env_var("TRUSTGUARD_API_KEY")` | Haystack Secret containing the evaluation credential. |
+| `api_base` | `https://trustguard.neuraltrust.ai` | Public HTTPS API origin. |
+| `direction` | `"input"` | Policy phase: `"input"` or `"output"`. |
+| `on_violation` | `"raise"` | `"raise"` stops with an exception; `"route"` returns only the verdict for `block`/`ask`. |
+| `timeout` | `5.0` | Positive HTTP timeout in seconds for each network operation, not an overall retry deadline. |
+| `max_retries` | `2` | Additional attempts for eligible transient failures; integer from 0 to 10. |
+| `collector_key` | `None` | Optional collector identifier when using a service token. This is not an API credential. |
+
+The optional keyword-only run arguments `session_id`, `consumer_id`, and `attributes` attach request context. `attributes` must contain JSON-compatible values. `consumer_id` can select a policy override configured in TrustGuard.
+
+```python
+with NeuralTrustGuard() as guard:
+    result = guard.run(
+        text="What is the capital of France?",
+        session_id="example-session",
+        consumer_id="example-consumer",
+        attributes={"source": {"application": "haystack-example"}},
+    )
+```
+
+Configure policies in TrustGuard. These components do not accept a per-request policy ID or detector ID.
+
+## Verdicts and errors
+
+| TrustGuard status | Component behavior |
+| --- | --- |
+| `allow` | Forward original content. |
+| `report` | Forward original content and return findings in `verdict`. |
+| `transform` | Forward validated transformed content. |
+| `block` | Raise or omit the passing output, according to `on_violation`. |
+| `ask` | Stop like `block`, preserving the `ask` status. This package does not grant approval. |
+
+The verdict contains `status` and, when provided, `findings`, `trace_id`, and `request_id`. Findings can contain sensitive evidence from evaluated content. Select the fields your application needs and apply its normal access and retention controls; avoid dumping the full verdict into logs.
+
+Import the exceptions from the same public component namespace:
+
+| Exception | Meaning |
+| --- | --- |
+| `NeuralTrustBlockedError` | `block` or `ask`; exposes `status` and a verdict limited to status and validated correlation IDs. |
+| `NeuralTrustAuthenticationError` | Missing/invalid credentials or HTTP 401/403. |
+| `NeuralTrustUnavailableError` | Retryable failure exhausted the configured attempts. |
+| `NeuralTrustRequestError` | Rejected request or non-retryable transport failure. |
+| `NeuralTrustInvalidResponseError` | Malformed verdict or unusable transformation. |
+| `NeuralTrustError` | Base class for the errors above. |
+
+Exceptions use sanitized messages. A Haystack pipeline may wrap component failures in its own execution exception; inspect the chained cause when handling a specific NeuralTrust error at the pipeline boundary.
+
+Retries cover timeouts, connection failures, and HTTP 429/502/504. TLS failures, authentication failures, other HTTP errors, and invalid verdicts are not converted into passing content. Retry delays are bounded and honor supported `Retry-After` values up to five seconds. There is no fail-open mode; `on_violation="route"` changes only the handling of valid `block` and `ask` verdicts.
+
+## Save and restore pipelines
+
+```python
+from haystack import Pipeline
+
+from haystack_integrations.components.guardrails.neuraltrust import NeuralTrustGuard
+
+pipeline = Pipeline()
+pipeline.add_component("guard", NeuralTrustGuard())
+serialized = pipeline.dumps()
+restored = Pipeline.loads(serialized)
+```
+
+Environment-based Secrets serialize the variable name, never its resolved value. Set the credential in the restoring process before running the pipeline. `Secret.from_token(...)` is supported for direct use, but Haystack intentionally refuses to serialize token-based Secrets. The canonical `haystack_integrations` namespace also works with Haystack 3.x's default deserialization allowlist.
+
+## Scope
+
+- Text and text-only chat are supported. Document batches, tools, multimodal data, and native Agent lifecycle hooks are outside the components' supported interface.
+- A guard before/after an Agent covers its pipeline input/output. It does not intercept the Agent's internal model calls or tool actions.
+- Output evaluation happens after a completed reply. Tokens already delivered through a streaming callback cannot be withheld by a later pipeline component. Buffer replies when they must pass evaluation before delivery.
+- Detection and transformation depend on the collector policy, its direction, and the TrustGuard service. Local validation does not establish detection accuracy for every policy or input.
+
+See the [Haystack integration guide](https://docs.neuraltrust.ai/integrations/haystack) for usage documentation and the [contributing guide](https://github.com/NeuralTrust/neuraltrust-haystack/blob/main/CONTRIBUTING.md) for development checks.
+
+Release history is recorded in the [changelog](https://github.com/NeuralTrust/neuraltrust-haystack/blob/main/CHANGELOG.md).
+
+## License
+
+This package is distributed under the [MIT License](https://github.com/NeuralTrust/neuraltrust-haystack/blob/main/LICENSE).

neuraltrust_haystack-0.1.0.dist-info/RECORD

@@ -0,0 +1,12 @@
+haystack_integrations/components/guardrails/neuraltrust/__init__.py,sha256=Fn9XCy9XlPM7UJbsfCSCNuhVAYVqmLRlnHvubOX7xuU,677
+haystack_integrations/components/guardrails/neuraltrust/_base.py,sha256=tn6-S3W1jqkrt1xARfFCs7S_R7jVBuoWEXKpmvkKMyo,10314
+haystack_integrations/components/guardrails/neuraltrust/_client.py,sha256=LI53EsDokBn_8i1fepq4GAzT2xNfLyr1luxEg1Nn-vs,15894
+haystack_integrations/components/guardrails/neuraltrust/_version.py,sha256=VDsBswzfU7gNsBkIaxxV6tsi0ixlms3WjN7HYgZJZ2g,46
+haystack_integrations/components/guardrails/neuraltrust/chat_guard.py,sha256=85PuQWAJLqtX7MfPq2dr6OND03JQZriuOHiDd0BnU3w,4424
+haystack_integrations/components/guardrails/neuraltrust/errors.py,sha256=VLwxVn7_Ik_qy6NUSR31GJMncCsrH3mDnPEx45_ayVk,1548
+haystack_integrations/components/guardrails/neuraltrust/guard.py,sha256=5Ufk0_6MiL93EB6798oHiP8sdmZ85wbRRdEI6Yy4mgI,2667
+haystack_integrations/components/guardrails/neuraltrust/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+neuraltrust_haystack-0.1.0.dist-info/METADATA,sha256=Hjq-obBepQ3x88GUsnXn0K4Ao6ZLcWiL4rG851UCcio,13058
+neuraltrust_haystack-0.1.0.dist-info/WHEEL,sha256=zOwg4jB6zX2kU910N-cMawjivD6tO8NEWvE12je1bVk,87
+neuraltrust_haystack-0.1.0.dist-info/licenses/LICENSE,sha256=QAfBoTjdYqFWAoNpzfHjWN2bc3Py1uXPq2tqnjKp150,1068
+neuraltrust_haystack-0.1.0.dist-info/RECORD,,

neuraltrust_haystack-0.1.0.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: hatchling 1.32.0
+Root-Is-Purelib: true
+Tag: py3-none-any

neuraltrust_haystack-0.1.0.dist-info/licenses/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 NeuralTrust
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.